CVE-2026-10038

Name of the Vulnerable Software and Affected Versions The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More versions prior to 1.8.11.2

Description An Insecure Direct Object Reference and Authorization Bypass allows authenticated attackers with Subscriber-level access or higher to delete arbitrary attachments from the Media Library. The issue occurs during the profile avatar update flow because the save avatar() function in Charitable Profile Form calls wp delete attachment() using an attachment ID from the user's avatar meta without verifying ownership. Additionally, Charitable Data Processor::process picture() returns the raw posted value when no file is uploaded, enabling the avatar user meta to be poisoned with a target attachment ID. Exploitation involves a two-request chain: first poisoning the stored avatar meta value and then triggering the deletion through a standard avatar upload.

Recommendations Update the plugin to version 1.8.11.2 or later. As a temporary workaround, restrict access to the profile avatar update functionality for users with Subscriber-level permissions.