The Charitable donation plugin allows authenticated administrators to submit an 's' query parameter that is incorporated directly into an SQL statement without proper escaping. This flaw permits attackers with edit_others_donations capability to inject additional SQL clauses, enabling extraction of sensitive data from the WordPress database. The weakness is a classic example of a parameter‐level SQL injection (CWE‑89).

The flaw exists in all released versions of the Charitable plugin up to and including 1.8.10.4. Users running any of these versions on WordPress are vulnerable if they have access to the donation management admin area. The issue is confined to the donation management component and does not affect the core WordPress installation or other plugins.

With a CVSS score of 6.5 the vulnerability presents a moderate severity level. The exploit requires only authenticated access to the WordPress admin area and the edit_others_donations capability, which is commonly granted to site administrators or privileged contributors. Because the EPSS score is not available and the issue is not listed in the CISA KEV catalog, the likelihood of out‑of‑band exploitation appears limited; however, an attacker who has legitimate credentials can exploit the injection to read database tables. The risk is mitigated by restricting the capability to a minimal set of trusted users and by applying the vendor’s recommended patch as soon as a newer release is available.