A high-severity SQL injection vulnerability in the Charitable plugin allows authenticated subscribers to potentially extract sensitive database information.

This vulnerability is a SQL injection flaw (CWE-89) triggered via improper neutralization of special elements in database commands. It requires a user with subscriber-level privileges to interact with the vulnerable component.

Successful exploitation of this vulnerability can lead to the unauthorized disclosure of sensitive data stored within the WordPress database. Given the CVSS score of 8.5, this high-severity flaw poses a significant risk to data confidentiality, potentially exposing donor information or internal application data, and may lead to broader site compromise.

Immediate Action: Update the WordPress Charitable plugin to version 1.8.12.2 or higher to remediate the underlying SQL injection vulnerability.

Proactive Monitoring: Monitor database query logs for unusual syntax or high volumes of requests originating from subscriber-level user accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection patterns targeting WordPress plugins.

Public Exploit Available: Unknown

This vulnerability presents a clear risk to the integrity and confidentiality of the WordPress database. Administrators should prioritize updating the Charitable plugin to the patched version immediately. If an immediate update is not feasible, restrict subscriber access or implement strict WAF filtering to prevent malicious SQL injection attempts.