CVE-2026-39691: Crypto Donation Box Auth Bypass Flaw

CVE-2026-39691 Overview

CVE-2026-39691 is a missing authorization vulnerability in the AdAstraCrypto Cryptocurrency Donation Box – Bitcoin & Crypto Donations WordPress plugin. The flaw stems from incorrectly configured access control security levels [CWE-862]. Attackers can reach restricted plugin functionality over the network without authentication or user interaction. All plugin versions up to and including 2.2.13 are affected. Successful exploitation results in limited integrity impact on the WordPress site. The issue was published to the National Vulnerability Database (NVD) on April 8, 2026 and last modified on April 24, 2026.

Critical Impact

Unauthenticated network attackers can invoke protected plugin functionality on sites running Cryptocurrency Donation Box versions through 2.2.13, modifying state without proper authorization checks.

Affected Products

• Cryptocurrency Donation Box – Bitcoin & Crypto Donations WordPress plugin (cryptocurrency-donation-box)
• All versions from initial release through 2.2.13
• WordPress sites with the AdAstraCrypto plugin installed and active

Discovery Timeline

• 2026-04-08 - CVE-2026-39691 published to NVD
• 2026-04-24 - Last updated in NVD database

Technical Details for CVE-2026-39691

Vulnerability Analysis

The vulnerability is classified under [CWE-862] Missing Authorization. The plugin exposes functionality that should be restricted, but fails to verify the caller's permissions before executing privileged actions. Patchstack categorizes the issue as broken access control caused by incorrectly configured security levels.

The attack vector is network-based with low complexity. No authentication or user interaction is required. The impact is limited to integrity, with no direct confidentiality or availability degradation. An attacker can issue crafted HTTP requests to plugin endpoints and trigger functions intended only for authorized users.

Root Cause

The root cause is the absence of capability checks (current_user_can()) or nonce verification on plugin endpoints. WordPress plugins must enforce authorization on every privileged action handler, including AJAX callbacks and REST routes. The Cryptocurrency Donation Box plugin omits these checks on at least one handler, allowing unauthenticated callers to invoke protected logic.

Attack Vector

An attacker sends an HTTP request directly to the vulnerable plugin endpoint on a target WordPress site. Because authorization is not enforced server-side, the request executes as if it came from a privileged user. The impact is limited to integrity modifications within the plugin's scope, such as altering donation configuration data. Refer to the Patchstack WordPress Vulnerability Advisory for additional technical detail.

Detection Methods for CVE-2026-39691

Indicators of Compromise

• Unexpected modifications to plugin settings or donation wallet addresses in the WordPress database
• Unauthenticated POST or GET requests to admin-ajax.php or plugin REST routes referencing cryptocurrency-donation-box actions
• Anomalous traffic patterns targeting plugin endpoints from unfamiliar source IP addresses

Detection Strategies

• Inventory WordPress sites and identify those running the cryptocurrency-donation-box plugin at version 2.2.13 or earlier
• Review web server access logs for unauthenticated requests invoking plugin action handlers
• Compare current plugin configuration against known-good baselines to detect tampering

Monitoring Recommendations

• Enable WordPress audit logging to record plugin option changes and administrative actions
• Forward web server and WordPress logs to a centralized analytics platform for anomaly detection
• Alert on HTTP 200 responses to unauthenticated requests targeting plugin endpoints

How to Mitigate CVE-2026-39691

Immediate Actions Required

• Update the Cryptocurrency Donation Box plugin to a version newer than 2.2.13 once a vendor-patched release is available
• Audit current plugin settings, including configured cryptocurrency wallet addresses, for unauthorized changes
• Restrict administrative access to WordPress via IP allowlisting and multi-factor authentication

Patch Information

At the time of NVD publication, the advisory lists affected versions through <= 2.2.13. Monitor the Patchstack WordPress Vulnerability Advisory and the WordPress plugin repository for fixed-version availability.

Workarounds

• Deactivate and remove the Cryptocurrency Donation Box plugin until a patched release is published
• Deploy a Web Application Firewall (WAF) rule to block unauthenticated requests to the plugin's action handlers
• Limit access to wp-admin and admin-ajax.php to authenticated sessions where feasible

# Example: deactivate the vulnerable plugin using WP-CLI
wp plugin deactivate cryptocurrency-donation-box
wp plugin status cryptocurrency-donation-box