CVE-2026-7619: WordPress Charitable Plugin SQLi Vulnerability

CVE-2026-7619 Overview

CVE-2026-7619 is a SQL Injection vulnerability [CWE-89] affecting the Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More. The flaw exists in all versions up to and including 1.8.10.4. The plugin fails to escape the user-supplied s parameter and does not properly prepare the underlying SQL query. Authenticated users with the edit_others_donations capability can append arbitrary SQL clauses to existing queries. Successful exploitation enables extraction of sensitive information stored in the WordPress database.

Critical Impact

Authenticated attackers with donation management access can exfiltrate database contents through SQL injection in the donation list table search functionality.

Affected Products

• Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More, versions through 1.8.10.4
• WordPress sites granting the edit_others_donations capability to non-administrator roles
• Sites running the vulnerable class-charitable-donations.php and class-charitable-donation-list-table.php files

Discovery Timeline

• 2026-05-13 - CVE-2026-7619 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-7619

Vulnerability Analysis

The vulnerability resides in the donation list table component of the Charitable plugin. When an authenticated user submits a search query through the donation management admin area, the s parameter is passed into a SQL statement without adequate escaping. The plugin also fails to use prepared statements consistently when constructing the query inside the donations class. Attackers leverage this gap to append additional SQL clauses such as UNION SELECT operations. Database contents including user records, donor information, and stored secrets can be returned through the application response.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The affected code paths in class-charitable-donation-list-table.php at line 837 and class-charitable-donations.php at line 89 concatenate the s parameter into a SQL string. The query lacks $wpdb->prepare() placeholders for the user-controlled value. Existing escaping routines are insufficient to neutralize injection payloads.

Attack Vector

Exploitation requires network access to the WordPress admin interface and an authenticated session with the edit_others_donations capability. This capability is typically granted to administrators but can be delegated to fundraising staff or campaign managers. The attacker submits a crafted search string through the donation list table. The injected payload executes against the WordPress database and returns sensitive data to the attacker.

No verified exploit code is published. The vulnerability mechanism is documented in the Wordfence vulnerability advisory and the WordPress plugin changeset 3529172.

Detection Methods for CVE-2026-7619

Indicators of Compromise

• HTTP requests to /wp-admin/edit.php?post_type=donation containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA within the s query parameter
• Anomalous database errors logged by WordPress or MySQL when the donation list table is rendered
• Unexpected long response times on donation admin pages, consistent with time-based blind SQL injection
• Admin sessions performing repeated searches with encoded payloads such as %27 or 0x literals

Detection Strategies

• Inspect web server access logs for requests to donation admin endpoints with suspicious patterns in the s parameter
• Enable MySQL general query logging temporarily to identify injected clauses appended to wp_posts queries
• Deploy a web application firewall rule targeting SQL injection signatures on admin POST and GET requests
• Audit WordPress roles to identify accounts holding the edit_others_donations capability

Monitoring Recommendations

• Forward WordPress admin access logs and MySQL error logs to a centralized SIEM for correlation
• Alert on authenticated users issuing admin search requests containing SQL metacharacters
• Monitor for privilege changes that add the edit_others_donations capability to non-administrator roles

How to Mitigate CVE-2026-7619

Immediate Actions Required

• Update the Charitable plugin to the version that includes changeset 3529172 or later
• Review and reduce assignment of the edit_others_donations capability to the minimum required users
• Rotate WordPress administrator and database credentials if exploitation is suspected
• Audit the wp_users and donor tables for unauthorized data access

Patch Information

The vendor addressed the issue in WordPress plugin changeset 3529172, which modifies class-charitable-donations.php to properly prepare the SQL query against the s parameter. Site operators should upgrade to the fixed release published after version 1.8.10.4. Patch details are referenced in the WordPress plugin trac entry.

Workarounds

• Temporarily revoke the edit_others_donations capability from non-trusted roles until the patch is applied
• Restrict access to /wp-admin/ paths by IP allowlist at the web server or WAF layer
• Deploy WAF signatures that block SQL injection patterns in admin search parameters
• Disable the Charitable plugin if it is not actively in use

# Example WP-CLI commands to enumerate and remove the vulnerable capability
wp role list --fields=role,capabilities | grep edit_others_donations
wp cap remove editor edit_others_donations
wp plugin update charitable