The Donations WordPress plugin through version 1.0 fails to sanitize a user supplied parameter before embedding it in a SQL query. This flaw allows a logged‑in administrator or other high‑privilege user to inject arbitrary SQL that can read, modify, or delete database records, potentially compromising the integrity and confidentiality of the site.

Any WordPress installation that has the Donations plugin (Unknown vendor) installed with a version of 1.0 or older is affected. The plugin is deployed on the WordPress core without vendor identification.

The CVSS score of 4.1 indicates a moderate severity, while the EPSS score of less than 1% shows that exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog, further suggesting lower immediate risk for large‑scale attacks. In practice, exploitation would require an attacker to compromise an administrator account or otherwise gain administrative privileges to send the malicious input.