Description

Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T15:17:08.320Z",
  "pubdate": "2026-08-18T15:17:08.320Z",
  "executiveSummary": "An unauthenticated broken access control vulnerability has been identified in the Charitable plugin affecting versions <= 1.8.11.3. This security flaw introduces significant risk to the integrity and confidentiality of the underlying WordPress installation by allowing unauthenticated remote actors to bypass intended authorization checks. The absence of strict access controls on sensitive endpoints enables malicious users to interact with restricted functionalities without supplying valid credentials or possessing appropriate privileges. The exploitation of this vulnerability does not require prior authentication or complex preconditions, lowering the barrier to entry for attackers. Successful exploitation can lead to unauthorized data exposure, state manipulation, or execution of privileged operations normally reserved for authorized administrators or donors. Organizations utilizing affected versions of the Charitable plugin face potential compromise of sensitive crowdfunding data and unauthorized modification of application resources, necessitating immediate remediation through patching or restricting network exposure.",
  "technicalDetails": "The vulnerability stems from inadequate enforcement of access control lists and missing capability checks within the Charitable plugin <= 1.8.11.3 codebase. Specifically, request handlers and functional endpoints responsible for processing sensitive actions fail to adequately validate whether the incoming HTTP request originates from an authenticated user possessing the requisite administrative or managerial capabilities. The root cause is situated in the application logic layer, where authorization routines are either omitted entirely or improperly implemented, allowing arbitrary unauthenticated HTTP requests to successfully invoke backend functions.\nFrom an attack flow perspective, an unauthenticated remote attacker initiates the exploitation phase by targeting the exposed endpoints via standard network protocols such as HTTP or HTTPS. Because the application lacks robust session validation and privilege verification mechanisms, the server processes the incoming payload without challenging the sender's identity. The payload behavior depends on the specific targeted endpoint, but typically involves executing unauthorized administrative actions, retrieving restricted database records, or modifying plugin configurations. Post-exploitation impact ranges from unauthorized data exfiltration to complete functional compromise of the plugin's operational environment, depending on the breadth of the exposed controller methods.\nNetwork exposure is universal for any web server hosting the vulnerable WordPress installation, as the endpoints are accessible externally via standard web ports. The vulnerability requires zero authentication and zero prior privileges, granting anonymous external actors the ability to interact directly with backend logic designated for privileged roles. Remediation requires strict enforcement of WordPress capability checks, such as current_user_can() validations, and implementation of robust nonce verification to ensure that state-changing requests originate exclusively from legitimate, authenticated sessions."
}