CVE-2026-77189 Overview
The Charitable – Donation & Fundraising Platform plugin for WordPress contains a SQL injection vulnerability in the [charitable_donors] shortcode. The flaw affects all versions up to and including 1.8.12.1. The order shortcode attribute is passed into database queries without adequate escaping or query preparation. Authenticated users with Contributor-level access or above can append arbitrary SQL to existing queries via draft or pending post previews. Successful exploitation allows extraction of sensitive information from the WordPress database, including user credentials and donor records.
Critical Impact
Contributor-level attackers can exfiltrate database contents by injecting SQL through the order attribute of the [charitable_donors] shortcode rendered in draft post previews.
Affected Products
- Charitable – Donation & Fundraising Platform plugin for WordPress
- All versions up to and including 1.8.12.1
- Donation Forms, Recurring Donations & Fundraising Campaigns feature set
Discovery Timeline
- 2026-09-01 - CVE-2026-77189 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-77189
Vulnerability Analysis
The vulnerability resides in the Charitable donor query pipeline. The [charitable_donors] shortcode accepts an order attribute from user-supplied content. That attribute flows into SQL clause construction inside the plugin's donor query class without prepared statements or strict allow-list validation. Because the shortcode renders during post preview, any user able to create draft or pending posts can trigger the query. Contributor accounts satisfy that requirement, providing a low-privilege entry point on any WordPress site that permits contributor registration or has such accounts provisioned. The classification aligns with [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.
Root Cause
The donor query builder concatenates the order shortcode attribute directly into the generated SQL fragment. The plugin does not call wpdb::prepare() on the resulting statement, nor does it constrain the value to an allow-list such as ASC or DESC. The relevant construction paths appear in abstract-class-charitable-query.php and class-charitable-donor-query.php, with the shortcode entry point in class-charitable-donors-shortcode.php. See the WordPress Charitable Query Class and WordPress Donors Shortcode Class source for the vulnerable code paths.
Attack Vector
An attacker authenticates as a Contributor and creates a draft or pending post containing the [charitable_donors] shortcode with a crafted order attribute. Requesting the post preview forces the plugin to render the shortcode server-side, executing the injected SQL against the WordPress database. The attacker can chain UNION SELECT statements to read arbitrary tables, including wp_users password hashes and session tokens.
No verified public proof-of-concept code is available. Refer to the Wordfence Vulnerability Intelligence advisory for exploitation details.
Detection Methods for CVE-2026-77189
Indicators of Compromise
- Draft or pending posts authored by Contributor accounts that include the [charitable_donors] shortcode with unusual order attribute values containing SQL keywords such as UNION, SELECT, SLEEP, or --.
- Web server access logs showing preview=true or preview_id= requests followed by anomalous database load or slow query log entries.
- Unexpected reads against wp_users, wp_usermeta, or Charitable donor tables originating from PHP-FPM workers handling preview requests.
Detection Strategies
- Enable MySQL general query logging or slow query logging on staging systems to identify injected UNION-based statements originating from donor query functions.
- Inspect wp_posts rows with post_status in (draft,pending) for shortcode content matching a regex such as \[charitable_donors[^\]]*order=["'][^"']*(select|union|sleep|benchmark).
- Correlate Contributor-role logins with post preview requests in access logs to surface reconnaissance patterns.
Monitoring Recommendations
- Alert on any new post creation by Contributor-level accounts that contains Charitable shortcodes.
- Monitor for outbound HTTP requests from the WordPress host immediately following preview requests, which may indicate exfiltration attempts.
- Track database query response times and row counts for the donor query class; sudden spikes suggest injection probing.
How to Mitigate CVE-2026-77189
Immediate Actions Required
- Update the Charitable plugin to a version newer than 1.8.12.1 once the vendor releases a fixed build reflecting the Charitable changeset 3662994.
- Audit all Contributor, Author, and Editor accounts and remove any that are unused or unrecognized.
- Rotate WordPress salts in wp-config.php and force password resets if compromise is suspected.
Patch Information
The vendor addressed the flaw in the Charitable plugin changeset referenced above. Administrators should upgrade through the WordPress plugin dashboard or via WP-CLI using wp plugin update charitable. Verify the installed version is greater than 1.8.12.1 after the update. Review the Wordfence Vulnerability Intelligence entry for the confirmed fixed version.
Workarounds
- Restrict Contributor role registration and require administrator approval for new low-privileged accounts until patching is complete.
- Deploy a web application firewall rule that blocks preview requests containing SQL metacharacters within shortcode attributes.
- Temporarily disable the Charitable plugin on sites where Contributor accounts cannot be tightly controlled.
- Remove the [charitable_donors] shortcode from any draft or pending posts pending remediation.
# Update the Charitable plugin via WP-CLI
wp plugin update charitable
wp plugin get charitable --field=version
# List and audit Contributor accounts
wp user list --role=contributor --fields=ID,user_login,user_registered
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
