CVE-2025-11893: Charitable WordPress Plugin SQLi Flaw

CVE-2025-11893 Overview

CVE-2025-11893 is an authenticated SQL Injection vulnerability in the Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin. The flaw affects all versions up to and including 1.8.8.4. It stems from insufficient escaping of the donation_ids parameter and inadequate preparation of the underlying SQL query. Authenticated attackers with Subscriber-level access or above can append additional SQL queries to existing statements and extract sensitive data from the WordPress database. Exploitation requires a paid donation, raising the practical barrier to abuse. The issue is tracked under CWE-89 (SQL Injection).

Critical Impact
Authenticated Subscriber-level users can extract sensitive data from the WordPress database through SQL Injection in the donation_ids parameter.

Affected Products

Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
All plugin versions up to and including 1.8.8.4
WordPress sites accepting paid donations via the Charitable plugin

Discovery Timeline

2025-10-25 - CVE-2025-11893 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11893

Vulnerability Analysis

The vulnerability resides in the Charitable plugin's query abstraction layer, specifically the abstract-class-charitable-query.php file referenced in the WordPress Plugin Code Review. The donation_ids parameter is concatenated into an SQL query without being properly escaped or bound through a prepared statement. An authenticated attacker can supply crafted input that breaks out of the intended query context and appends arbitrary SQL clauses. Because the underlying query executes against the WordPress database, attackers can retrieve sensitive content such as user records, password hashes, session tokens, and donation metadata.

Exploitation requires Subscriber-level authentication or higher and a paid donation, which constrains opportunistic abuse but does not prevent determined attackers from registering, donating, and exploiting the plugin. The EPSS score reflects a low near-term exploitation likelihood, but the impact on data confidentiality remains significant for sites holding personally identifiable information (PII).

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The plugin trusts the user-supplied donation_ids parameter and inserts it into a query string without calling $wpdb->prepare() with proper placeholders or applying type-casting on identifier values. The WordPress Plugin Changeset Log shows the upstream remediation applied to the query construction logic.

Attack Vector

The attack vector is network-based and requires authentication. An attacker registers a WordPress account, completes a paid donation to satisfy the gating condition, and then submits a request containing a malicious donation_ids payload. The injected SQL is appended to the existing query and executed by the database, returning attacker-controlled output through subsequent plugin responses or inferable through blind techniques.

The vulnerability is described in detail in the Wordfence Vulnerability Report. No public proof-of-concept exploit code is referenced in the NVD record.

Detection Methods for CVE-2025-11893

Indicators of Compromise

HTTP requests containing SQL metacharacters such as UNION, SELECT, --, or /* within the donation_ids parameter.
Unexpected database errors logged by WordPress or MySQL referencing the charitable query layer.
Newly registered Subscriber-level accounts that complete a minimal paid donation immediately followed by abnormal donation-related requests.
Sudden spikes in outbound traffic from the WordPress host following authenticated requests to Charitable plugin endpoints.

Detection Strategies

Inspect web server access logs for requests targeting Charitable plugin endpoints with non-numeric values in donation_ids.
Enable MySQL general or slow query logging on staging and look for malformed WHERE donation_id IN (...) clauses originating from the plugin.
Deploy a Web Application Firewall (WAF) rule that rejects requests where donation_ids contains characters outside 0-9 and comma separators.

Monitoring Recommendations

Correlate authentication events with Charitable plugin requests to identify low-privilege accounts probing donation endpoints.
Alert on database error rates exceeding baseline for the WordPress site, particularly errors referencing syntax or column count mismatches.
Monitor file integrity on wp-content/plugins/charitable/ to confirm patched files are in place after upgrade.

How to Mitigate CVE-2025-11893

Immediate Actions Required

Update the Charitable plugin to a version newer than 1.8.8.4 that includes the fix referenced in changeset 3382719.
Audit Subscriber-level and higher accounts for suspicious activity, focusing on accounts created shortly before unusual donation requests.
Rotate WordPress administrative credentials and session secrets if exploitation is suspected.
Review database audit logs for unauthorized SELECT queries against wp_users, wp_usermeta, and donation tables.

Patch Information

The vendor addressed the issue in the Charitable plugin trunk via changeset 3382719, which updates the query construction in includes/abstracts/abstract-class-charitable-query.php. Site administrators should upgrade through the WordPress plugin updater or by replacing the plugin directory with the latest release. Verify post-upgrade that the plugin version reported in the WordPress admin is greater than 1.8.8.4.

Workarounds

Restrict new user registrations or disable Subscriber-level self-registration until the patch is applied.
Place the WordPress site behind a WAF and add a virtual patch that filters non-numeric content from the donation_ids parameter.
Temporarily disable the Charitable plugin if patching is not immediately feasible and donations can be paused.
Apply least-privilege controls to the WordPress database user, removing access to tables that the plugin does not require.

bash

# Example WAF rule fragment for filtering donation_ids
# ModSecurity-style rule
SecRule ARGS:donation_ids "!@rx ^[0-9,]+$" \
    "id:1011893,phase:2,deny,status:400,log,\
     msg:'CVE-2025-11893: Invalid donation_ids parameter'"