This flaw arises from the missing cryptographic verification of Stripe webhook events. An attacker can forge a payment_intent.succeeded payload, causing the plugin to mark a pending donation as completed even when no payment has occurred. This misleads site owners and donors into believing a donation was processed and may trigger thank‑you messages or allocation of resources based on a nonexistent contribution. The weakness is a case of insufficient data authenticity verification.

The WordPress component Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More, supplied by smub, is affected in all releases up to and including version 1.8.9.7. Any WordPress site that installs this version and accepts Stripe webhook traffic is vulnerable.

The CVSS base score of 5.3 indicates moderate severity. EPSS information is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known exploitation yet. The likely attack vector is an unauthenticated attacker sending a forged Stripe webhook to the plugin’s endpoint. Once the webhook is accepted, the attacker can alter donation records, potentially defrauding donors or masking fraudulent activity.