CVE-2026-73391: Total Donations SQLi Vulnerability

CVE-2026-73391 Overview

CVE-2026-73391 is an unauthenticated SQL injection vulnerability affecting the Total Donations WordPress plugin in versions up to and including 2.0.5. The flaw allows remote attackers to inject arbitrary SQL statements into database queries without prior authentication. The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Attackers can reach the vulnerable code path over the network with no user interaction. Successful exploitation can expose sensitive donor and site data, and impact the availability of the underlying database.

Critical Impact
Unauthenticated attackers can inject SQL statements against WordPress sites running Total Donations <= 2.0.5, exposing stored data and enabling denial-of-service against the database.

Affected Products

Total Donations WordPress plugin versions <= 2.0.5
WordPress installations with the Total Donations plugin enabled
Donor and payment records stored in the WordPress database

Discovery Timeline

2026-08-19 - CVE-2026-73391 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73391

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input before it is concatenated into SQL queries executed by the Total Donations plugin. Because the affected endpoints do not require authentication, any remote client can submit crafted request parameters that alter the intended query structure.

The scope classification (S:C) indicates that exploitation impacts resources beyond the vulnerable component, reaching the WordPress database shared with the host site. Confidentiality impact is high, while integrity remains unaffected and availability sees limited impact. The EPSS score is 0.241% at the 15.575 percentile as of 2026-08-20.

Root Cause

The root cause is a failure to sanitize or parameterize input passed into SQL statements. The plugin builds queries through string concatenation rather than using the WordPress $wpdb->prepare() API with placeholders. This design allows metacharacters such as single quotes, UNION, and comment sequences to break out of the intended query context.

Attack Vector

Exploitation occurs over the network against the WordPress site hosting the plugin. An attacker sends an HTTP request containing a malicious payload in a parameter consumed by the vulnerable query. No credentials, tokens, or user interaction are required. Technical details are documented in the Patchstack Vulnerability Analysis.

Because the flaw is unauthenticated and reachable over the internet, automated scanners and mass-exploitation tools can identify vulnerable hosts at scale. Attackers typically follow initial confirmation with UNION-based extraction of the wp_users table to obtain password hashes.

Detection Methods for CVE-2026-73391

Indicators of Compromise

HTTP requests to Total Donations plugin endpoints containing SQL metacharacters such as ', --, UNION SELECT, or SLEEP(
Anomalous SELECT queries in database logs referencing WordPress core tables from plugin code paths
Sudden outbound traffic spikes following requests to /wp-content/plugins/totaldonations/ URIs
New or modified administrator accounts in wp_users without a corresponding admin session

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL injection patterns targeting /wp-admin/admin-ajax.php actions registered by Total Donations
Correlate access logs with database slow-query logs to surface time-based blind injection attempts using SLEEP() or BENCHMARK()
Alert on unauthenticated requests to plugin endpoints that return unusually large response bodies, indicating data extraction

Monitoring Recommendations

Enable verbose logging on the WordPress database and retain logs for at least 90 days
Monitor for repeated 500 or 200 responses on plugin endpoints from a single source IP
Track file integrity on wp-content/plugins/totaldonations/ to detect attacker-planted webshells following exploitation

How to Mitigate CVE-2026-73391

Immediate Actions Required

Disable the Total Donations plugin until a patched version is confirmed installed
Restrict access to WordPress admin and AJAX endpoints via IP allowlisting where operationally feasible
Rotate WordPress administrator passwords and any API keys stored in the database
Review database audit logs for evidence of unauthorized SELECT activity against wp_users and wp_options

Patch Information

No vendor patch reference is available in the NVD entry at time of publication. Refer to the Patchstack Vulnerability Analysis for the latest remediation guidance and any updated plugin release beyond 2.0.5.

Workarounds

Deactivate and remove the Total Donations plugin from wp-content/plugins/ until a fixed release is available
Deploy a virtual patch through a WAF that blocks SQL injection payloads on plugin request URIs
Enforce least-privilege database credentials for the WordPress user, removing FILE and SUPER privileges

bash

# Configuration example: block requests to the vulnerable plugin at the web server
# nginx snippet
location ~* /wp-content/plugins/totaldonations/ {
    deny all;
    return 403;
}