{
 "id": "WPSEC-2026-2977",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2977/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2977/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2977/index.md",
 "title": "Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) <= 1.8.15 - Unauthenticated Insufficient Verification of Data Authenticity to Donation Status Manipulation via PayPal IPN",
 "description": "The Charitable plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity via the PayPal IPN handler in all versions up to, and including, 1.8.15. This is due to the process_web_accept() function comparing the donation key only after the business email, currency, refund and failure branches had already changed the donation, and then marking the donation as failed when the key did not match. This makes it possible for unauthenticated attackers to send forged IPN notifications that refund other donors' donations or mark them as failed, provided the non-default 'Disable IPN Verification' setting is enabled.",
 "plugin": {
  "slug": "charitable",
  "name": "Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)",
  "full_name": "Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)",
  "wordpress_org": "https://wordpress.org/plugins/charitable/",
  "advisories_url": "https://wpsec.com/vuln/plugin/charitable/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/charitable"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-345"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.8.15.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.8.15.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.8.15.1",
 "remediation": "Update to 1.8.15.1 or later.",
 "fix_released": "2026-11-11T13:15:47+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:14:35.699119+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2977/",
  "https://plugins.svn.wordpress.org/charitable/tags/1.8.15.1/",
  "https://wordpress.org/plugins/charitable/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/charitable",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}