Unauthenticated users can exploit a broken access control flaw in the Charitable plugin for WordPress, allowing them to invoke privileged plugin actions without any authentication. The vulnerability stems from improper enforcement of permission checks and is identified as CWE‑862. Attackers could, for instance, create or delete donation campaigns, access sensitive data, or modify the plugin's behavior.

The flaw affects WordPress sites using the Charitable plugin version 1.8.11.3 and earlier, as distributed by Syed Balkhi. The affected component is the plugin's administration interface, which is intended for authenticated WordPress users. The specified version range includes all releases up to and including 1.8.11.3.

The CVSS score for this vulnerability is 7.5, indicating a high potential impact. EPSS is not available, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting it may not have been widely exploited yet. Nevertheless, because the flaw can be triggered by any internet‑facing WordPress installation with the vulnerable plugin, the likelihood of exploitation remains significant. An attacker can access the vulnerable endpoints remotely without credentials, making the attack vector unauthenticated and purely web‑based.