CVE-2026-73390: Total Donations Privilege Escalation Flaw

CVE-2026-73390 Overview

CVE-2026-73390 is an unauthenticated privilege escalation vulnerability in the Total Donations WordPress plugin versions 2.0.5 and earlier. The flaw allows a remote attacker to elevate privileges without authentication, granting administrative control over affected WordPress sites. The weakness is categorized under [CWE-266: Incorrect Privilege Assignment].

The vulnerability is exploitable over the network with low complexity and requires no user interaction. Successful exploitation compromises the confidentiality, integrity, and availability of the target WordPress installation. Site administrators running the Total Donations plugin should treat this issue as urgent given the unauthenticated attack surface.

Critical Impact
An unauthenticated remote attacker can escalate privileges to an administrative role on any WordPress site running Total Donations <= 2.0.5, enabling full site takeover.

Affected Products

WordPress Total Donations plugin versions <= 2.0.5
WordPress installations with Total Donations active
Sites accepting donations through the affected plugin

Discovery Timeline

2026-08-19 - CVE-2026-73390 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73390

Vulnerability Analysis

The Total Donations plugin <= 2.0.5 contains an incorrect privilege assignment flaw that permits an unauthenticated actor to escalate privileges within WordPress. The attacker interacts with the plugin over HTTP or HTTPS without providing valid credentials and obtains elevated permissions on the target site.

Once privileges are escalated, the attacker can perform actions reserved for administrators. These actions include installing malicious plugins, modifying content, exfiltrating donor data, and pivoting to the underlying WordPress user store. The vulnerability affects the confidentiality, integrity, and availability of the site simultaneously.

The current EPSS probability is 0.274% with a percentile of 19.872, indicating limited public exploitation signals at the time of publication. However, WordPress plugin privilege escalation flaws typically attract opportunistic scanning shortly after disclosure.

Root Cause

The root cause is incorrect privilege assignment [CWE-266] within Total Donations. The plugin exposes functionality that assigns elevated capabilities or role changes without properly verifying the requester's authenticated identity or authorization. Missing capability checks and absent nonce validation on privileged actions allow anonymous requests to trigger role modification.

Attack Vector

The attack vector is network-based. An attacker sends a crafted HTTP request to a vulnerable endpoint exposed by the Total Donations plugin. Because authentication and user interaction are not required, exploitation can be automated at internet scale against WordPress sites running the affected versions.

Specific exploitation details for CVE-2026-73390 are not published in the referenced advisory. Refer to the Patchstack Vulnerability Advisory for vendor-supplied technical context.

Detection Methods for CVE-2026-73390

Indicators of Compromise

Unexpected WordPress user accounts created with administrator role or elevated capabilities
Role or capability changes in the wp_usermeta table with no corresponding admin login session
Unauthenticated POST requests to Total Donations plugin endpoints under /wp-content/plugins/totaldonations/ or via admin-ajax.php actions tied to the plugin
Installation of unfamiliar plugins or themes shortly after suspicious plugin traffic

Detection Strategies

Inventory WordPress installations and flag any site with Total Donations <= 2.0.5 present, active or inactive
Review WordPress audit logs for unauthorized role escalations and new administrator accounts
Correlate web server access logs against Total Donations request paths for anonymous traffic patterns
Alert on modifications to wp_users and wp_usermeta that occur outside of authenticated admin sessions

Monitoring Recommendations

Enable a WordPress activity logging plugin to record user creation, role changes, and plugin installs
Forward WordPress and web server logs to a centralized SIEM for correlation and long-term retention
Monitor outbound connections from the WordPress host for signs of webshell or backdoor callbacks following exploitation

How to Mitigate CVE-2026-73390

Immediate Actions Required

Identify all WordPress instances running Total Donations <= 2.0.5 and prioritize them for remediation
Deactivate and remove the Total Donations plugin until a patched version is confirmed installed
Audit WordPress user accounts and revoke any unauthorized administrator or elevated-role users
Rotate credentials, API keys, and secrets stored within the affected WordPress environment

Patch Information

Consult the Patchstack Vulnerability Advisory for the current patch status and any fixed release provided by the plugin maintainer. If no patched version is available, uninstall the plugin.

Workarounds

Block public access to /wp-content/plugins/totaldonations/ paths at the web application firewall or reverse proxy
Restrict admin-ajax.php actions associated with Total Donations to authenticated administrators via WAF rules
Place the WordPress admin interface behind IP allowlisting or an authenticating proxy while remediation is in progress

bash

# Example nginx rule to block anonymous access to the vulnerable plugin path
location ~* /wp-content/plugins/totaldonations/ {
    deny all;
    return 403;
}