CVE-2026-78568: Total Donations WordPress Plugin SQL Injection

CVE-2026-78568 Overview

CVE-2026-78568 is a SQL Injection vulnerability affecting the Total Donations plugin for WordPress in all versions up to and including 2.0.5. The flaw stems from insufficient escaping on a user-supplied parameter combined with a lack of preparation on the underlying SQL query. Unauthenticated attackers can append additional SQL statements to existing queries and extract sensitive information from the WordPress database. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated remote attackers can extract sensitive data from the WordPress database, including user credentials, donor personally identifiable information, and payment metadata.

Affected Products

WordPress Total Donations plugin, all versions through 2.0.5
WordPress sites running the plugin with public-facing donation endpoints
Any environment where the vulnerable plugin remains active regardless of user role configuration

Discovery Timeline

2026-08-25 - CVE-2026-78568 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78568

Vulnerability Analysis

The Total Donations plugin exposes a code path that concatenates unvalidated user input directly into a SQL statement. The plugin fails to apply WordPress's $wpdb->prepare() parameterization or equivalent escaping through esc_sql() before executing the query. Attackers exploit this by supplying crafted parameter values that terminate the intended query and append arbitrary SQL clauses such as UNION SELECT statements.

Because the attack requires no authentication and can be delivered over the network with a single HTTP request, exploitation complexity is low. Successful exploitation yields read access to any table the WordPress database user can query, which typically includes wp_users, wp_usermeta, and donation transaction tables.

Root Cause

The root cause is a missing input sanitization boundary between the HTTP request handler and the database layer. The plugin trusts request parameters and interpolates them into SQL strings without prepared statement placeholders. This pattern violates the WordPress database API contract and produces a classic first-order SQL injection primitive.

Attack Vector

Exploitation occurs over the network against the WordPress site's HTTP endpoints exposed by the plugin. An attacker crafts a request containing SQL metacharacters in the vulnerable parameter. The server executes the concatenated query and returns results either directly in the response body or through inference channels such as boolean-based or time-based side channels.

Refer to the Patchstack advisory and the Wordfence vulnerability analysis for parameter-level detail.

Detection Methods for CVE-2026-78568

Indicators of Compromise

HTTP requests to Total Donations plugin endpoints containing SQL metacharacters such as ', UNION, SELECT, SLEEP(, or -- in query parameters
Web server access logs showing unusually long query strings or encoded payloads (%27, %20UNION%20) targeting plugin URIs
Database error entries in debug.log or PHP error logs referencing malformed queries originating from the plugin
Anomalous outbound data volume from the WordPress host following requests to donation-related endpoints

Detection Strategies

Deploy a WordPress-aware web application firewall with signatures for SQL injection patterns targeting plugin parameters
Enable MySQL general query log or audit log and alert on queries containing suspicious UNION SELECT or boolean-based patterns originating from the WordPress database user
Correlate WordPress access logs with database query logs to identify request-to-query causality for the vulnerable plugin

Monitoring Recommendations

Monitor for unauthenticated requests to Total Donations plugin routes and rate-limit repeat offenders
Track file integrity of plugin PHP files under wp-content/plugins/totaldonations/ to detect tampering
Baseline the volume of SELECT queries against wp_users and alert on spikes that coincide with plugin traffic

How to Mitigate CVE-2026-78568

Immediate Actions Required

Deactivate and remove the Total Donations plugin until a patched version is confirmed available from the vendor
Rotate all WordPress administrator passwords and force password resets for all site users, assuming credential material may have been extracted
Rotate the WordPress wp-config.php secret keys and salts to invalidate any exfiltrated session tokens
Review database access logs for evidence of prior exploitation dating back to plugin installation

Patch Information

No vendor patch information is listed in the NVD entry at the time of publication. All versions up to and including 2.0.5 remain vulnerable. Consult the Patchstack advisory and Wordfence vulnerability entry for the most current remediation guidance.

Workarounds

Block requests to Total Donations plugin endpoints at the reverse proxy or WAF layer until the plugin is removed or patched
Restrict the WordPress database user to the minimum privileges required and revoke access to any tables not needed by the plugin
Enforce virtual patching rules that reject requests containing SQL metacharacters in plugin parameters

bash

# Nginx location block to deny access to the vulnerable plugin path
location ~* /wp-content/plugins/totaldonations/ {
    deny all;
    return 403;
}

# ModSecurity rule to block SQLi patterns in query strings
SecRule ARGS "@detectSQLi" \
    "id:1078568,phase:2,deny,status:403,log,\
    msg:'CVE-2026-78568 Total Donations SQLi attempt'"