CVE-2025-11893

Name of the Vulnerable Software and Affected Versions The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More versions prior to 1.8.8.5

Description The Charitable – Donation Plugin for WordPress is susceptible to SQL Injection via the donation ids parameter. Insufficient escaping of user-supplied input and inadequate preparation of existing SQL queries allow authenticated attackers with Subscriber-level access or higher to inject additional SQL queries into existing database queries. This can lead to the extraction of sensitive information from the database. Exploitation requires a paid donation. The API endpoint potentially affected is not explicitly mentioned.

Recommendations Update The Charitable – Donation Plugin for WordPress to version 1.8.8.5 or later.