Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) <= 1.8.15 - Unauthenticated Insufficient Verification of Data Authenticity to Donation Status Manipulation via PayPal IPN

ID

WPSEC-2026-2977

Plugin

Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) (charitable)

Affected

all versions before 1.8.15.1

Remediation

Update to 1.8.15.1 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness

CWE-345

Usage

Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12

Attack surface

Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) on WPSec AttackSurface

Fix released

2026-11-11

Published

2026-11-12

Description

The Charitable plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity via the PayPal IPN handler in all versions up to, and including, 1.8.15. This is due to the process_web_accept() function comparing the donation key only after the business email, currency, refund and failure branches had already changed the donation, and then marking the donation as failed when the key did not match. This makes it possible for unauthenticated attackers to send forged IPN notifications that refund other donors' donations or mark them as failed, provided the non-default 'Disable IPN Verification' setting is enabled.

References

• https://wpsec.com/vuln/WPSEC-2026-2977/
• https://plugins.svn.wordpress.org/charitable/tags/1.8.15.1/
• https://wordpress.org/plugins/charitable/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS