A high-severity SQL Injection vulnerability exists in the "Charitable – Donation Plugin for WordPress". This flaw allows an unauthenticated attacker to manipulate the website's database by sending a specially crafted request. Successful exploitation could lead to the theft of sensitive donor information, website defacement, or a complete compromise of the affected WordPress site.

The plugin is vulnerable to SQL Injection because it fails to properly sanitize user-supplied data in the donation_ids parameter before using it in a database query. An attacker can inject malicious SQL commands into this parameter. When the application processes the request, these commands are executed by the backend database, allowing the attacker to read, modify, or delete database contents and potentially escalate privileges.

This vulnerability is rated as High severity with a CVSS score of 8.8. Exploitation could have significant negative impacts on the organization, including a data breach of sensitive donor information such as names, email addresses, and donation history. This can lead to severe reputational damage, loss of donor trust, and potential regulatory fines. Furthermore, an attacker could leverage this access to modify website content, create rogue administrator accounts, or use the compromised server to launch further attacks, resulting in costly incident response and business disruption.

Immediate Action:

• Update Plugin: Immediately update the "Charitable – Donation Plugin for WordPress" to the latest version provided by the vendor, which contains a patch for this vulnerability.
• Review and Remove: If the plugin is not critical to business operations, consider deactivating and removing it entirely to eliminate the attack surface.
• Review Security: Conduct a review of WordPress security settings, ensuring administrative users have strong, unique passwords and that file permissions are set correctly.

Proactive Monitoring:

• Web Server Logs: Monitor web server access logs for requests containing suspicious or malformed SQL syntax in the donation_ids parameter.
• WAF/IDS Logs: Review Web Application Firewall (WAF) and Intrusion Detection System (IDS) logs for alerts related to SQL injection signatures targeting the affected plugin's endpoints.
• Database Activity: Monitor for unusual database queries, such as those that are unexpectedly complex, long-running, or access tables outside of the plugin's normal scope of operation.

Compensating Controls:

• Web Application Firewall (WAF): Implement a properly configured WAF with rulesets designed to detect and block common SQL injection attack patterns. This can serve as a critical defense layer if immediate patching is not feasible.
• Principle of Least Privilege: Ensure the database user account for the WordPress installation has only the minimum permissions required for the application to function. This can limit the impact of a successful SQL injection attack.

Public Exploit Available: false

Given the high CVSS score of 8.8, this vulnerability poses a significant risk to the organization and should be remediated with urgency. We strongly recommend that all system administrators immediately identify WordPress instances running the vulnerable "Charitable" plugin and apply the vendor-supplied patch. Although this CVE is not currently listed on the CISA KEV list, its severity makes it a prime candidate for future exploitation. Prioritize patching on all internet-facing systems to prevent potential data breaches and system compromise.