Description

The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-21T12:16:23.870Z",
  "pubdate": "2026-08-21T12:16:23.870Z",
  "executiveSummary": "An improper authentication and webhook verification vulnerability exists in the Charitable WordPress plugin prior to version 1.8.12. The flaw arises because the plugin fails to properly validate the authenticity of incoming Square payment webhook events in its default configuration. This security oversight permits unauthenticated remote attackers to craft and transmit forged HTTP webhook notifications directly to the application endpoint.\nThe primary impact of this vulnerability is the unauthorized state manipulation of donation transactions, specifically allowing malicious actors to fraudulently mark unpaid or fictitious donations as successfully paid within the system without executing any legitimate financial transactions through the Square payment gateway. This poses severe integrity risks to financial records, order management workflows, and digital asset fulfillment.\nThe affected product is the Charitable WordPress plugin for versions below 1.8.12. Exploitation requires network access to the target WordPress site's exposed webhook listener URL and does not require any authentication, user interaction, or prior privileges. Risk implications are critical for organizations relying on automated donation processing, as successful exploitation undermines financial accounting and revenue tracking mechanisms.",
  "technicalDetails": "The root cause of this vulnerability lies in the missing cryptographic signature validation or shared secret verification within the Charitable WordPress plugin's Square webhook event handler. Payment gateway webhooks typically utilize a dedicated mechanism, such as HMAC-SHA256 headers containing a hashed payload signed with a webhook secret, to prove that incoming HTTP POST requests originate from the legitimate payment processor. In versions prior to 1.8.12, the Charitable plugin processes incoming JSON payloads without verifying these authenticity headers in its default configuration.\nThe vulnerable component is the webhook handling routine responsible for parsing asynchronous notification events sent by the Square API. Because network exposure is inherent to webhook endpoints—requiring public accessibility so external services can deliver HTTP POST requests—the lack of token or signature validation leaves the endpoint exposed to arbitrary external invocation.\nThe attack flow proceeds as follows. First, an unauthenticated attacker discovers or derives the public webhook endpoint URL exposed by the Charitable plugin. Next, the attacker crafts a malicious HTTP POST request containing a forged JSON payload simulating a successful payment event notification (such as invoice.payment_made or order.fulfillment_updated) associated with a targeted donation ID. Because the application lacks validation mechanisms to authenticate the request origin or check cryptographic signatures against the expected Square secret, the endpoint parses the incoming payload as a legitimate server-to-server notification.\nUpon receiving and processing the forged payload, the vulnerable component executes internal state transition logic, updating the status of the specified donation record from pending to completed or paid. No post-exploitation persistence is typically required, as the direct financial and database impact is achieved instantaneously through the state modification. Attackers can leverage this repeatedly to register arbitrary donations as fully paid, bypassing all gateway-level charge validation routines."
}