A user‑supplied parameter, donation_ids, is insufficiently escaped within the Charitable plugin’s SQL queries. This flaw leads to an injectable query vector that allows the attacker to append and execute additional SQL commands, potentially extracting confidential data from the WordPress database. The vulnerability is a classic CWE‑89 case of unsanitized input being embedded into a database statement.

The affected product is the Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More by smub. Versions up to and including 1.8.8.4 are vulnerable. The plugin runs within the WordPress environment and provides donation handling features to site users.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1% signals a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. It is inferred from the description that an attacker must possess at least Subscriber‑level permissions and successfully create a paid donation to inject the malicious donation_ids value. Once injected, the attacker can exploit the raw SQL query to retrieve or manipulate sensitive database content.