Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) <= 1.8.15 - Unauthenticated Sensitive Information Exposure via Malformed Session Cookie
- ID
- WPSEC-2026-2978
- Plugin
- Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) (charitable)
- Affected
- from 1.5.0 before 1.8.15.1
- Remediation
- Update to 1.8.15.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) on WPSec AttackSurface
- Fix released
- Published
Description
The Charitable plugin for WordPress is vulnerable to Sensitive Information Exposure via the session handling in versions 1.5.0 up to, and including, 1.8.15. This is due to a malformed 'charitable_session' cookie being reduced to an empty session ID. That empty ID points to a single shared '_wp_session_' option row, and visitors without a session cookie (for example when cookies are turned off for cookie-consent compliance) also write their session data, including the donation keys that grant access to receipts, to that row. This makes it possible for unauthenticated attackers to load that shared session by sending a malformed cookie, and then view other donors' donation receipts and the personal details shown on them.
References
- https://wpsec.com/vuln/WPSEC-2026-2978/
- https://plugins.svn.wordpress.org/charitable/tags/1.8.15.1/
- https://wordpress.org/plugins/charitable/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS