This vulnerability is an unauthenticated SQL Injection in the Total Donations plugin for WordPress versions 2.0.5 and earlier (CWE‑89). An attacker can supply crafted input that is unsanitized and directly incorporated into database queries, allowing the execution of arbitrary SQL commands. The impact is the ability to read, modify, or delete data stored by the plugin, which can lead to full compromise of the WordPress site’s data integrity and confidentiality.

KlbTheme’s Total Donations plugin for WordPress, version 2.0.5 and earlier.

The CVSS score of 9.3 indicates a severe threat level, with the attack complexity being low and exploitation requirements minimal due to the unauthenticated nature of the flaw. Based on the description, it is inferred that the injection is achieved by submitting malicious input through the donation form that is unsanitized and concatenated directly into a SQL query, enabling arbitrary commands. The EPSS score of < 1% indicates a very low, but non‑zero, likelihood of exploitation, reinforcing the high severity indicated by the CVSS score. The vulnerability is not currently listed in the CISA KEV catalog. Attackers can easily exploit this weakness remotely by submitting malicious payloads through the publicly accessible donation form, potentially using automated scripts to extract or manipulate data.