CVE-2026-73994: Charitable Auth Bypass Vulnerability

CVE-2026-73994 Overview

CVE-2026-73994 is an unauthenticated broken access control vulnerability in the Charitable WordPress plugin through version 1.8.11.3. The flaw allows remote attackers to invoke privileged functionality without authentication, resulting in unauthorized modification of plugin data. The vulnerability is tracked under CWE-862: Missing Authorization and affects site owners who use Charitable to manage donations and fundraising campaigns.

Critical Impact

Unauthenticated attackers can reach protected plugin actions over the network and tamper with integrity-sensitive data on affected WordPress sites.

Affected Products

• Charitable WordPress plugin versions <= 1.8.11.3
• WordPress sites running the vulnerable plugin with public HTTP access
• Fundraising and donation workflows managed through Charitable

Discovery Timeline

• 2026-08-18 - CVE-2026-73994 published to NVD
• 2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73994

Vulnerability Analysis

The vulnerability is a Broken Access Control weakness in the Charitable plugin for WordPress. Charitable exposes plugin actions that fail to validate the caller's authorization state before executing sensitive operations. An unauthenticated attacker sends crafted HTTP requests to the WordPress site and reaches functionality that should be limited to privileged users.

The impact is scoped to integrity. Attackers can alter plugin-managed data such as campaign configurations, donation records, or settings exposed by the vulnerable endpoints. Confidentiality and availability are not directly impacted according to the assigned metrics, but tampered fundraising data can produce downstream financial and reputational harm.

Successful exploitation requires no user interaction, no privileges, and no prior foothold. Any WordPress site running Charitable 1.8.11.3 or earlier and reachable over the network is exposed until the plugin is updated.

Root Cause

The root cause is missing authorization checks on plugin actions, consistent with CWE-862. The affected handlers do not enforce capability checks (for example, current_user_can()) or nonce validation (for example, check_admin_referer()) before executing state-changing logic. Because WordPress AJAX and admin-post endpoints are reachable without authentication when registered with the nopriv variant, missing checks expose those actions to anonymous callers.

Attack Vector

Exploitation is remote and network-based. An attacker issues HTTP POST or GET requests to the WordPress site targeting the vulnerable Charitable action endpoints. No authentication cookie, API key, or user interaction is required. See the Patchstack WordPress Vulnerability Report for advisory details.

A verified public proof-of-concept is not listed in the enriched data. The EPSS probability is 0.323% with a percentile of 25.282 as of 2026-08-21, indicating limited observed exploitation likelihood at this time.

Detection Methods for CVE-2026-73994

Indicators of Compromise

• Unauthenticated HTTP requests to wp-admin/admin-ajax.php or admin-post.php with action parameters registered by the Charitable plugin
• Unexpected modifications to Charitable campaigns, donation entries, or plugin settings in the WordPress database
• Anomalous POST traffic to Charitable endpoints from single source IPs at high frequency
• Web server logs showing successful 200 responses to Charitable action endpoints without associated authenticated sessions

Detection Strategies

• Review WordPress access logs for requests to Charitable actions that lack a valid wordpress_logged_in_* cookie
• Audit the wp_charitable_* database tables for records created or altered outside of normal administrator workflows
• Correlate WordPress audit-log plugin events with web server access logs to identify anonymous state changes

Monitoring Recommendations

• Enable a WordPress activity logging plugin to capture plugin-level configuration and content changes
• Forward web server and WordPress audit logs to a centralized SIEM for correlation and alerting
• Alert on spikes in requests to admin-ajax.php targeting Charitable action names from unauthenticated sessions

How to Mitigate CVE-2026-73994

Immediate Actions Required

• Update the Charitable plugin to the version that supersedes 1.8.11.3 as published by the vendor
• If patching is not immediately possible, deactivate the Charitable plugin on internet-facing WordPress sites
• Review Charitable campaigns, donations, and settings for unauthorized modifications since deployment of 1.8.11.3 or earlier

Patch Information

Refer to the Patchstack advisory for the fixed release information. Upgrade to a Charitable version later than 1.8.11.3 through the WordPress plugin updater or by downloading the current package from the plugin repository.

Workarounds

• Restrict access to wp-admin/admin-ajax.php and wp-admin/admin-post.php at the web application firewall to block unauthenticated requests carrying Charitable action values
• Apply virtual patching rules from a WordPress-aware WAF to block requests to the vulnerable Charitable endpoints until the plugin is updated
• Disable the Charitable plugin on staging or non-production sites where it is not required

# Example: block unauthenticated access to Charitable AJAX actions via nginx
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "^charitable_") {
        # Require authenticated WordPress session cookie
        if ($http_cookie !~* "wordpress_logged_in_") {
            return 403;
        }
    }
    include fastcgi_params;
    fastcgi_pass php_upstream;
}