A generic SQL Injection flaw exists in the Charitable donation plugin for WordPress, triggered through the 'order' attribute of the [charitable_donors] shortcode. The plugin fails to escape the user‑supplied value and does not prepare the underlying SQL query, enabling an attacker to append additional statements. An authenticated user with Contributor role or higher can execute the vulnerability, allowing extraction of sensitive information from the database.

The affected product is the Charitable – Donation & Fundraising Platform plugin from smub, which is used for donation forms, recurring donations, and fundraising campaigns. All plugin versions up to and including 1.8.12.1 are vulnerable. The plugin is normally installed on WordPress sites; any installation running a version in this range is impacted.

The CVSS score of 6.5 reflects a moderate to high severity. Since the EPSS score is unavailable, the exact probability of exploitation is unclear, but the vulnerability is listed as not in the CISA KEV catalog. The attack requires authenticated access with at least Contributor privileges, which is common enough in many sites. Once exploited, an attacker can read or modify data in the WordPress database, potentially exposing donor information and financial records. Protection against exploitation would require either updating the plugin or implementing effective input validation and access controls.