CVE-2026-16650 Overview
CVE-2026-16650 affects the Charitable WordPress plugin in versions prior to 1.8.12. The plugin fails to verify the authenticity of incoming Square payment webhook events under its default configuration. Unauthenticated attackers can forge webhook notifications that mark donations as paid without any real payment being processed. The flaw is categorized under [CWE-345]: Insufficient Verification of Data Authenticity. Charity organizations relying on the plugin for Square-processed donations can record fraudulent donation records that appear legitimate in reporting and administrative dashboards.
Critical Impact
Remote attackers can forge Square webhook events over the network without authentication and mark donations as paid, undermining the integrity of donation records.
Affected Products
- Charitable WordPress plugin versions prior to 1.8.12
- WordPress sites using Charitable with the Square payment gateway integration
- Deployments running the default Charitable webhook configuration
Discovery Timeline
- 2026-08-21 - CVE-2026-16650 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-16650
Vulnerability Analysis
The Charitable plugin exposes a webhook endpoint that receives payment status notifications from Square. In a properly implemented integration, the receiver validates the X-Square-Signature (or equivalent HMAC signature header) using a shared signature key before trusting the payload. In the vulnerable default configuration, Charitable accepts webhook requests without verifying this signature.
Attackers who know or guess a donation identifier can send crafted HTTP requests to the webhook endpoint. The plugin processes these requests as authentic Square events and transitions the corresponding donation record to a paid state. The result is a data integrity issue affecting financial reporting rather than direct compromise of the WordPress host.
Root Cause
The root cause is missing cryptographic verification of webhook message authenticity. The plugin trusts inbound HTTP requests on the Square webhook route without validating the signature header against the expected HMAC computed with the merchant's Square signature key. This is a classic [CWE-345] weakness where a service accepts unauthenticated messages from a channel that should be authenticated.
Attack Vector
An unauthenticated remote attacker sends a forged HTTP POST request to the plugin's Square webhook URL. The request body mimics a legitimate Square payment.updated event and references a target donation identifier. Because signature verification is absent, the plugin marks the donation as paid. No user interaction, credentials, or elevated privileges are required. See the WPScan Vulnerability Advisory for additional technical context.
Detection Methods for CVE-2026-16650
Indicators of Compromise
- Donation records transitioning to a paid state without a corresponding transaction in the Square merchant dashboard.
- HTTP POST requests to the Charitable Square webhook endpoint from IP addresses outside Square's published webhook ranges.
- Webhook payloads lacking a valid X-Square-Signature header or containing signatures that fail verification when replayed.
Detection Strategies
- Reconcile donation records in Charitable against authoritative Square transaction reports on a scheduled cadence.
- Enable web server access logging on the webhook route and alert on request bursts or requests from unexpected source networks.
- Compare the Charitable plugin version reported by WordPress against 1.8.12 across all managed sites.
Monitoring Recommendations
- Forward WordPress, web server, and Charitable plugin logs to a centralized analytics platform for correlation with Square API activity.
- Alert on donation status changes that occur outside expected checkout flows, such as those without an associated checkout session.
- Monitor for anomalous donation volumes, particularly small-value paid donations used to probe the webhook logic.
How to Mitigate CVE-2026-16650
Immediate Actions Required
- Upgrade the Charitable WordPress plugin to version 1.8.12 or later on every affected site.
- Configure the Square signature key inside the Charitable settings so webhook verification is enforced after upgrade.
- Audit donation records created since Square integration was enabled and reconcile against the Square merchant dashboard.
Patch Information
The vendor addressed the issue in Charitable 1.8.12 by validating incoming Square webhook signatures. Site administrators should update through the WordPress plugin dashboard or via WP-CLI. Details are available in the WPScan Vulnerability Advisory.
Workarounds
- Restrict access to the Charitable Square webhook endpoint at the web application firewall or reverse proxy, allowing only Square's published webhook source ranges.
- Temporarily disable the Square payment gateway in Charitable until the plugin is updated and the signature key is configured.
- Require manual reconciliation of donation status changes against the Square dashboard before treating records as authoritative.
# Update the Charitable plugin using WP-CLI
wp plugin update charitable --version=1.8.12
wp plugin list --name=charitable --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
