CVE-2026-7619
Last modified
CVE-2026-7619 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 1.8.10.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with access to the donation management admin area (requiring the edit_others_donations capability) and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.. EPSS estimates a 0.28% chance of exploitation in the next 30 days.
Description
The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 1.8.10.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with access to the donation management admin area (requiring the edit_others_donations capability) and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-7619?
How severe is CVE-2026-7619?
How do I fix CVE-2026-7619?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-76179An improper protection of authentication tokens vulnerabilit…9.8
- CVE-2026-7618The EnvíaloSimple: Email Marketing y Newsletters plugin for …4.9
- CVE-2026-76183Authentication Bypass by Alternate Name vulnerability in Apa…9.8
- CVE-2026-76186Apache Airflow Keycloak provider: from Airflow 3.3 the Keycl…9.1
- CVE-2026-76187Apache Airflow Keycloak provider: the unauthenticated token …9.8
- CVE-2026-76189CAI Content Credentials is affected by an Integer Underflow …6.2
- CVE-2026-76190ColdFusion is affected by an Improper Neutralization of Dire…8.6
- CVE-2026-76191Animate is affected by an Improper Control of Generation of …8.2
- CVE-2026-76192InDesign Desktop is affected by a NULL Pointer Dereference v…5.5
- CVE-2026-76193Adobe Campaign Classic (ACC) is affected by a Server-Side Re…10
- CVE-2026-76194CAI Content Credentials is affected by an Improper Input Val…4.3
- CVE-2026-76195Adobe Campaign Classic (ACC) is affected by an Improper Neut…10
Are you affected by CVE-2026-7619?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST