CVE-2026-77189

Name of the Vulnerable Software and Affected Versions Charitable – Donation & Fundraising Platform versions prior to 1.8.13

Description An issue exists where authenticated attackers with contributor-level access and above can perform a generic SQL Injection. This occurs due to insufficient escaping of user-supplied parameters and a lack of sufficient preparation of the SQL query. Attackers can use the order attribute within the [charitable donors] shortcode to append additional SQL queries and extract sensitive information from the database. This shortcode is accessible to contributors through draft or pending post previews.

Recommendations Update the plugin to a version newer than 1.8.12.1. As a temporary mitigation, restrict the ability of contributor-level users to create or preview posts containing the [charitable donors] shortcode.