CVE-2026-77189: Charitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute
The Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The [charitabledonors] shortcode is accessible to Contributor-level users via draft or pending post previews, providing an authenticated but low-privileged entry point for exploitation.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue in a typical WordPress deployment?
An attacker needs an authenticated WordPress account with at least the Contributor role. Contributor-level users can reach the affected [charitable_donors] shortcode through draft or pending post previews, so they do not need publishing privileges.
What access or interaction is required for exploitation?
The attacker must be authenticated and able to supply a malicious order attribute to the [charitable_donors] shortcode. No victim interaction is required.
What is the likely impact if exploitation succeeds?
The issue can allow additional SQL to be appended to existing database queries, potentially exposing sensitive information stored in the WordPress database. The provided severity vector indicates confidentiality impact, with no stated integrity or availability impact.
Which plugin versions are affected?
All Charitable versions through 1.8.12.1, including 1.8.12.1, are affected according to the provided information.