CVE-2026-10038: WordPress Charitable Plugin Auth Bypass

CVE-2026-10038 Overview

CVE-2026-10038 affects the Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin in all versions up to and including 1.8.11.1. The flaw is an Insecure Direct Object Reference (IDOR) [CWE-639] in the profile avatar update flow that allows authenticated users with Subscriber-level access or above to delete arbitrary attachments from the WordPress Media Library. The save_avatar() function in Charitable_Profile_Form calls wp_delete_attachment() on an attachment ID stored in the user's avatar meta without verifying ownership.

Critical Impact
Authenticated attackers can delete any attachment from the Media Library, including images, documents, and media referenced by donation campaigns or site pages.

Affected Products

Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
All versions up to and including 1.8.11.1
WordPress sites permitting Subscriber-level (or higher) user registration with the plugin active

Discovery Timeline

2026-06-06 - CVE-2026-10038 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-10038

Vulnerability Analysis

The vulnerability is an authorization bypass in the profile avatar update workflow of the Charitable plugin. When a user submits the profile form, Charitable_Profile_Form::save_avatar() reads an attachment ID from the user's avatar meta and passes it directly to wp_delete_attachment(). The code does not check whether the calling user owns the attachment referenced by that ID. As a result, the deletion routine operates on whatever attachment ID is stored in user meta, regardless of origin.

A second weakness in Charitable_Data_Processor::process_picture() compounds the issue. When no file is uploaded with the request, the function returns the raw posted value supplied by the user. That value is then written into the avatar user meta, allowing an attacker to poison the field with any attachment ID present on the site.

Root Cause

The root cause is missing authorization on an object reference. The plugin trusts the attachment ID stored in user meta as if it were a value the user is entitled to delete. Combined with the data processor returning user-controlled input verbatim, this creates a classic IDOR pattern where the object identifier is attacker-controlled and the server performs no ownership check before invoking a destructive operation.

Attack Vector

Exploitation requires a two-request chain from an authenticated account with Subscriber-level access or higher. In the first request, the attacker submits the profile form with no file upload and an arbitrary attachment ID in the avatar field, which poisons the avatar user meta with the target ID. In the second request, the attacker triggers a normal avatar upload flow, which causes save_avatar() to call wp_delete_attachment() against the poisoned ID. The targeted Media Library attachment is then deleted. The technical references in the plugin source identify the affected lines in class-charitable-profile-form.php and class-charitable-data-processor.php.

Detection Methods for CVE-2026-10038

Indicators of Compromise

Unexpected entries in WordPress logs showing wp_delete_attachment() calls originating from Subscriber accounts.
Missing media files in /wp-content/uploads/ that were previously referenced by posts, pages, or donation campaigns.
Repeated POST requests to the Charitable profile form endpoint from low-privilege accounts.
avatar user meta values that reference attachment IDs not owned by the corresponding user.

Detection Strategies

Audit the usermeta table for avatar keys whose values point to attachments where post_author does not match the user ID.
Monitor web server access logs for back-to-back profile form submissions where the first omits a file upload and the second includes one.
Correlate wp_posts deletions of attachment post types with the authenticated user session that triggered them.

Monitoring Recommendations

Enable WordPress audit logging for media deletion events and profile updates from non-administrator roles.
Alert on any Subscriber-level account performing more than one profile update within a short interval.
Track baseline Media Library counts and alert on unexpected attachment removals.

How to Mitigate CVE-2026-10038

Immediate Actions Required

Update the Charitable plugin to a version newer than 1.8.11.1 that includes the fix introduced in changeset 3557047.
If immediate patching is not possible, disable the Charitable plugin or restrict profile editing for low-privilege roles.
Review recent Media Library deletions and restore from backup any attachments removed without authorization.
Audit existing avatar user meta values and reset any that reference attachments not owned by the associated user.

Patch Information

The vendor addressed the issue in WordPress Charitable Changeset 3557047, which modifies class-charitable-profile-form.php to validate attachment ownership before deletion. Additional technical context is available in the Wordfence Vulnerability Report.

Workarounds

Restrict new user registration or limit it to roles that do not have access to the Charitable profile form.
Deploy a Web Application Firewall (WAF) rule that blocks POST requests to the Charitable profile endpoint containing an avatar parameter without a corresponding file upload.
Temporarily disable the avatar upload feature within the Charitable plugin configuration until patched.

bash

# Configuration example: identify potentially poisoned avatar meta values
wp db query "SELECT um.user_id, um.meta_value AS attachment_id, p.post_author \
  FROM wp_usermeta um \
  JOIN wp_posts p ON p.ID = um.meta_value \
  WHERE um.meta_key = 'avatar' \
    AND p.post_type = 'attachment' \
    AND p.post_author <> um.user_id;"