# Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) <= 1.8.15 - Unauthenticated Insufficient Verification of Data Authenticity to Donation Status Manipulation via PayPal IPN

- **ID:** WPSEC-2026-2977
- **Plugin:** Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) (`charitable`), https://wordpress.org/plugins/charitable/
- **Affected versions:** all versions before 1.8.15.1
- **Fixed in:** 1.8.15.1 (Update to 1.8.15.1 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/charitable
- **Fix released:** 2026-11-11
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2977/

## Description

The Charitable plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity via the PayPal IPN handler in all versions up to, and including, 1.8.15. This is due to the process_web_accept() function comparing the donation key only after the business email, currency, refund and failure branches had already changed the donation, and then marking the donation as failed when the key did not match. This makes it possible for unauthenticated attackers to send forged IPN notifications that refund other donors' donations or mark them as failed, provided the non-default 'Disable IPN Verification' setting is enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-2977/
- https://plugins.svn.wordpress.org/charitable/tags/1.8.15.1/
- https://wordpress.org/plugins/charitable/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2977/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.