{
 "id": "WPSEC-2026-2978",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2978/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2978/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2978/index.md",
 "title": "Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) <= 1.8.15 - Unauthenticated Sensitive Information Exposure via Malformed Session Cookie",
 "description": "The Charitable plugin for WordPress is vulnerable to Sensitive Information Exposure via the session handling in versions 1.5.0 up to, and including, 1.8.15. This is due to a malformed 'charitable_session' cookie being reduced to an empty session ID. That empty ID points to a single shared '_wp_session_' option row, and visitors without a session cookie (for example when cookies are turned off for cookie-consent compliance) also write their session data, including the donation keys that grant access to receipts, to that row. This makes it possible for unauthenticated attackers to load that shared session by sending a malformed cookie, and then view other donors' donation receipts and the personal details shown on them.",
 "plugin": {
  "slug": "charitable",
  "name": "Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)",
  "full_name": "Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)",
  "wordpress_org": "https://wordpress.org/plugins/charitable/",
  "advisories_url": "https://wpsec.com/vuln/plugin/charitable/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/charitable"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.5.0",
    "from_inclusive": true,
    "to": "1.8.15.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.5.0 before 1.8.15.1"
  ]
 },
 "introduced_in": "1.5.0",
 "fixed_in": "1.8.15.1",
 "remediation": "Update to 1.8.15.1 or later.",
 "fix_released": "2026-11-11T13:15:47+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:14:35.699119+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2978/",
  "https://plugins.svn.wordpress.org/charitable/tags/1.8.15.1/",
  "https://wordpress.org/plugins/charitable/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/charitable",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}