The Charitable WordPress plugin does not verify the authenticity of incoming Square payment webhook events in its default configuration, enabling an attacker to forge webhooks and mark donations as paid without any real transaction. This vulnerability permits unauthenticated state changes that can generate fictitious revenue entries, leading to fraudulent financial reporting and potential monetary loss.

Any WordPress site running Charitable plugin version 1.8.11 or earlier, when the default webhook signature verification setting is left disabled, is affected.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available; the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated external attacker sending HTTP requests to the Square webhook endpoint because the plugin accepts and processes signatures without validation. The exploit requires no special credentials and can be performed from any location that can reach the site, making the risk moderate but with real financial impact due to the false donation status.