Description

Subscriber SQL Injection in Charitable <= 1.8.12.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-31T21:17:49.803Z",
  "pubdate": "2026-08-31T21:17:49.803Z",
  "executiveSummary": "The Charitable plugin, in versions up to and including 1.8.12.1, contains a critical SQL Injection (SQLi) vulnerability.\nThis vulnerability allows authenticated users with Subscriber-level privileges to execute arbitrary SQL commands against the underlying WordPress database.\nThe flaw stems from insufficient neutralization of user-supplied data before incorporating it into database queries, resulting in improper sanitization and escaping.\nAn attacker can exploit this weakness to manipulate database queries, leading to unauthorized data exfiltration, modification, or deletion.\nThe impact includes full compromise of the database contents, potentially resulting in the loss of sensitive user information, administrative credential disclosure, or unauthorized privilege escalation.\nSuccessful exploitation requires the attacker to hold an active Subscriber account on the target WordPress installation.\nThis vulnerability poses a significant risk to the integrity and confidentiality of the site, necessitating prompt remediation.",
  "technicalDetails": "The vulnerability resides within the Charitable plugin's handling of user-supplied input that is passed to database interaction functions without adequate parameterization or sanitization.\nIn the affected versions (<= 1.8.12.1), the application fails to properly implement WordPress's `$wpdb->prepare()` mechanism or appropriate escaping functions like `esc_sql()` on input parameters processed during specific plugin actions available to Subscriber-level users.\nThe attack flow begins when a malicious actor, authenticated as a Subscriber, crafts an HTTP request targeting a vulnerable endpoint provided by the Charitable plugin. By injecting SQL syntax into parameters that are insecurely concatenated into a SQL statement, the attacker breaks out of the intended query structure.\nBecause the input is not sufficiently filtered, the database engine interprets the malicious input as part of the SQL command, rather than as literal data.\nAn attacker may leverage this capability to perform union-based SQL injection, allowing for the extraction of sensitive data from other tables within the WordPress database. Furthermore, error-based or blind SQL injection techniques can be utilized to infer information about the database schema, version, or specific data values.\nThe exploitation path often involves manipulating `WHERE` clauses or `ORDER BY` parameters that are processed dynamically. By injecting payload sequences such as 'OR 1=1' or subqueries, the attacker bypasses intended data access constraints.\nPost-exploitation impact is severe; given the nature of the database, an attacker could extract administrator password hashes, manipulate plugin configuration settings to achieve remote code execution, or drop tables to cause a denial of service.\nThis vulnerability is classified as an authenticated SQL injection because it requires a low-level account to access the vulnerable code path. The exposure is limited to the web server, but because it resides in a common plugin, it is reachable via standard HTTP(S) request vectors, making it highly exploitable for any site where user registration is enabled or a compromised Subscriber account is present."
}