CVE-2026-81287 Overview
CVE-2026-81287 is a SQL injection vulnerability in the WordPress Charitable plugin affecting versions up to and including 1.8.12.1. The flaw allows authenticated users with Subscriber-level privileges to inject arbitrary SQL statements into database queries. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Authenticated Subscriber users can extract sensitive database contents from WordPress installations running vulnerable versions of the Charitable donation plugin, exposing donor records and site secrets.
Affected Products
- WordPress Charitable Plugin versions <= 1.8.12.1
- WordPress sites with Subscriber-level registration enabled
- Donation-driven WordPress deployments using Charitable for fundraising
Discovery Timeline
- 2026-08-31 - CVE-2026-81287 published to the National Vulnerability Database
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-81287
Vulnerability Analysis
The Charitable plugin fails to properly sanitize user-supplied input before incorporating it into SQL queries. An attacker authenticated as a low-privileged Subscriber can craft malicious input that alters the intended query structure. Because WordPress permits open user registration on many sites, the Subscriber role is often trivially obtainable.
The scope-changed nature of the flaw indicates that a successful injection reaches beyond the plugin's own data boundary. Attackers can read arbitrary tables in the WordPress database, including wp_users, wp_usermeta, and plugin-specific donor tables. Confidentiality impact is high, while integrity remains unaffected and availability sees limited impact.
Root Cause
The root cause is missing or insufficient parameterization of SQL queries constructed from user-controlled parameters in Charitable's request handlers. WordPress provides $wpdb->prepare() for safe query construction, and failure to use it consistently results in classic SQL injection. The plugin likely concatenates request data directly into query strings.
Attack Vector
Exploitation requires network access to the WordPress site and valid Subscriber credentials. The attacker sends a crafted HTTP request to a vulnerable Charitable endpoint containing SQL syntax in a parameter that flows into an unsanitized query. Automated tooling such as sqlmap can enumerate injectable parameters once authenticated session cookies are supplied.
Refer to the Patchstack advisory for technical details on the affected endpoint and parameter.
Detection Methods for CVE-2026-81287
Indicators of Compromise
- HTTP requests to Charitable plugin endpoints containing SQL keywords such as UNION, SELECT, SLEEP(, or INFORMATION_SCHEMA in query parameters or POST bodies
- Unusual outbound database read patterns originating from the WordPress PHP worker, including bulk reads of wp_users and wp_usermeta
- Subscriber accounts registered shortly before anomalous requests to /wp-admin/admin-ajax.php or Charitable REST routes
- Web server access logs showing encoded payloads such as %27, %20OR%201=1, or -- in Charitable-related URIs
Detection Strategies
- Deploy Web Application Firewall (WAF) rules that inspect authenticated requests to Charitable endpoints for SQL metacharacters and boolean-based injection signatures
- Enable MySQL general query logging or slow query logging temporarily to identify malformed queries containing untrusted input concatenation
- Correlate Subscriber authentication events with immediate access to donation-related administrative endpoints
Monitoring Recommendations
- Monitor for spikes in 500-series HTTP responses from Charitable endpoints, which often accompany injection probing
- Alert on new Subscriber registrations from IP addresses associated with known scanning infrastructure or Tor exit nodes
- Track database query volume per PHP request; SQL injection extraction typically produces outlier query counts
How to Mitigate CVE-2026-81287
Immediate Actions Required
- Update the Charitable plugin to a version later than 1.8.12.1 as soon as a patched release is available from the vendor
- Disable open user registration on WordPress sites where Subscriber accounts are not operationally required
- Audit existing Subscriber accounts for anomalies and rotate WordPress secret keys defined in wp-config.php
- Review database logs and donor records for signs of unauthorized data extraction since the plugin was installed
Patch Information
Consult the Patchstack advisory for the Charitable plugin for the fixed version number and release notes. Apply the vendor-supplied update through the WordPress plugin management interface or via wp-cli using wp plugin update charitable.
Workarounds
- Deploy a virtual patch through a WordPress-aware WAF such as Patchstack, Wordfence, or a cloud WAF to block requests containing SQL injection patterns targeting Charitable endpoints
- Temporarily deactivate the Charitable plugin on sites that cannot immediately update if donation functionality can be paused
- Restrict access to /wp-admin/admin-ajax.php for Subscriber-role users at the reverse proxy where feasible
# Update Charitable via wp-cli once a fixed version is published
wp plugin update charitable --version=<fixed-version>
# Disable open registration until patched
wp option update users_can_register 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
