CVE-2026-7619: SQL Injection in Charitable WordPress Plugin
Plattform
wordpress
Komponente
charitable
Behoben in
1.8.10.5
CVE-2026-7619 describes a SQL Injection vulnerability discovered in the Charitable WordPress plugin, a popular tool for fundraising and recurring donations. This vulnerability allows authenticated attackers to inject malicious SQL queries, potentially leading to data breaches and unauthorized access. The vulnerability impacts versions 1.0.0 through 1.8.10.4, and a patch is available in version 1.8.10.5.
Erkenne diese CVE in deinem Projekt
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Auswirkungen und Angriffsszenarien
An attacker exploiting CVE-2026-7619 could gain unauthorized access to the WordPress database. This could involve extracting sensitive information such as donor names, email addresses, donation amounts, and potentially even payment details if stored in the database. Successful exploitation requires the attacker to have administrative privileges within the WordPress donation management area (specifically the editothersdonations capability). The blast radius extends to all data stored within the plugin's database tables. While the vulnerability requires authentication, the widespread use of WordPress and the plugin's popularity make it a significant risk, particularly for organizations handling sensitive financial data. This vulnerability shares similarities with other SQL injection flaws where attackers can bypass authentication and gain control of the database.
Ausnutzungskontext
CVE-2026-7619 was published on May 13, 2026. Its severity is currently pending further evaluation. There are no known public exploits or active campaigns targeting this vulnerability at the time of writing. The vulnerability is not listed on CISA’s Known Exploited Vulnerabilities catalog (KEV) or has not received an EPSS score, suggesting a low probability of near-term exploitation. Refer to the official WordPress security advisory for updates and further information.
Bedrohungsanalyse
Exploit-Status
CISA SSVC
CVSS-Vektor
Was bedeuten diese Metriken?
- Attack Vector
- Netzwerk — aus der Ferne über das Internet ausnutzbar. Kein physischer oder lokaler Zugriff erforderlich.
- Attack Complexity
- Niedrig — keine besonderen Bedingungen erforderlich. Zuverlässig ausnutzbar.
- Privileges Required
- Niedrig — jedes gültige Benutzerkonto ist ausreichend.
- User Interaction
- Keine — automatischer und lautloser Angriff. Das Opfer tut nichts.
- Scope
- Unverändert — Auswirkung auf das anfällige Komponente beschränkt.
- Confidentiality
- Hoch — vollständiger Vertraulichkeitsverlust. Angreifer kann alle Daten lesen.
- Integrity
- Keine — kein Integritätseinfluss.
- Availability
- Keine — kein Verfügbarkeitseinfluss.
Betroffene Software
Schwachstellen-Klassifikation (CWE)
Zeitleiste
- Reserved
- Veröffentlicht
Mitigation und Workarounds
The primary mitigation for CVE-2026-7619 is to immediately upgrade the Charitable WordPress plugin to version 1.8.10.5 or later. If upgrading is not immediately possible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) rule to filter out potentially malicious SQL injection attempts targeting the 's' parameter. Specifically, look for unusual characters or SQL keywords within the parameter value. Additionally, review and restrict user permissions within the WordPress donation management area, limiting the editothersdonations capability to only those who absolutely require it. After upgrading, verify the fix by attempting a SQL injection attack on the vulnerable parameter using a safe, non-destructive query to confirm that the escaping mechanism is now functioning correctly.
So beheben
Aktualisieren Sie auf Version 1.8.10.5 oder eine neuere gepatchte Version
Häufig gestellte Fragen
What is CVE-2026-7619 — SQL Injection in Charitable WordPress Plugin?
CVE-2026-7619 is a SQL Injection vulnerability affecting the Charitable WordPress plugin, allowing authenticated attackers to extract data from the database through manipulation of the 's' parameter. It impacts versions 1.0.0–1.8.10.4.
Am I affected by CVE-2026-7619 in Charitable WordPress Plugin?
You are affected if you are using the Charitable WordPress plugin versions 1.0.0 through 1.8.10.4. Check your plugin version and upgrade immediately if vulnerable.
How do I fix CVE-2026-7619 in Charitable WordPress Plugin?
Upgrade the Charitable WordPress plugin to version 1.8.10.5 or later. Consider implementing a WAF rule to filter malicious SQL injection attempts as a temporary workaround.
Is CVE-2026-7619 being actively exploited?
Currently, there are no known public exploits or active campaigns targeting CVE-2026-7619, but vigilance is still required.
Where can I find the official Charitable WordPress advisory for CVE-2026-7619?
Refer to the official WordPress security advisory and the Charitable plugin developer’s website for the latest information and updates regarding CVE-2026-7619.
Ist dein Projekt betroffen?
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Erkenne diese CVE in deinem Projekt
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Scannen Sie jetzt Ihr WordPress-Projekt – kein Konto
Laden Sie ein Manifest hoch (composer.lock, package-lock.json, WordPress Plugin-Liste…) oder fügen Sie Ihre Komponentenliste ein. Sie erhalten sofort einen Schwachstellenbericht. Das Hochladen einer Datei ist nur der Anfang: Mit einem Konto erhalten Sie kontinuierliche Überwachung, Slack/email-Benachrichtigungen, Multi-Projekt- und White-Label-Berichte.
Abhängigkeitsdatei hier ablegen
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...