Description

The Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The [charitable_donors] shortcode is accessible to Contributor-level users via draft or pending post previews, providing an authenticated but low-privileged entry point for exploitation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-01T06:16:37.960Z",
  "pubdate": "2026-09-01T06:16:37.960Z",
  "executiveSummary": "The Charitable – Donation & Fundraising Platform plugin for WordPress is susceptible to a SQL Injection vulnerability affecting all versions up to and including 1.8.12.1.\nThe vulnerability originates from the improper sanitization and lack of parameterized query usage for the 'order' attribute within the [charitable_donors] shortcode.\nAn authenticated attacker with contributor-level privileges or higher can leverage this flaw to execute arbitrary SQL commands against the underlying WordPress database.\nSuccessful exploitation allows attackers to perform unauthorized data extraction, potentially compromising sensitive information stored within the database.\nThe attack vector is triggered by inserting malicious payloads into the shortcode attribute when a user previews a post, which processes the shortcode on the backend.\nThis vulnerability represents a significant security risk for platforms relying on the Charitable plugin, as it permits low-privileged users to circumvent intended database access restrictions.",
  "technicalDetails": "The vulnerability resides within the processing logic of the [charitable_donors] shortcode, specifically where the 'order' attribute is handled. The application fails to adequately escape or sanitize the user-supplied input before incorporating it into a database query string.\nThe root cause is identified as the use of unsanitized input in SQL queries that lack proper preparation. Because the plugin does not utilize WordPress's built-in prepared statement functions (such as $wpdb->prepare()) for this specific attribute, the input is treated as trusted data.\nAn attacker can exploit this by crafting a malicious 'order' shortcode attribute containing SQL syntax. For example, by injecting 'order' parameters such as 'DESC, (SELECT ...)', the attacker can manipulate the query logic to include subqueries or append additional SQL operations.\nThe attack flow proceeds as follows: First, a user with Contributor-level access creates or edits a post draft. Second, they insert the [charitable_donors order='...'] shortcode into the post content, substituting the attribute with a malicious SQL payload. Third, when the user triggers a preview of the post, the WordPress rendering engine processes the shortcode.\nDuring this processing, the vulnerable component passes the user-controlled 'order' value directly into the SQL query construction process. This allows the injected SQL to be executed by the database engine within the context of the current database user's privileges.\nThe impact is significant, as the vulnerability facilitates unauthorized data exfiltration. Attackers can extract data from other tables, access user metadata, or potentially identify configuration details that could lead to further compromise. Because this is a standard SQL injection, the attacker can leverage UNION-based techniques or boolean-based blind injection depending on the specific query structure.\nThe vulnerability is limited to authenticated users, specifically those with at least contributor-level access. This implies that the threat actor must already have a valid, logged-in account on the WordPress site. However, the accessibility of shortcode previews via draft or pending posts provides a reliable entry point for exploitation without the need for publishing content publicly."
}