The Charitable – Donation Plugin for WordPress contains an authorization bypass vulnerability (CWE-639) due to improper validation of the ID parameter in the update_core_user() function. This allows unauthenticated attackers to escalate privileges by modifying credentials of any user account, including administrators. The vulnerability affects all versions up to and including 1.8.1.14. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation permits an attacker to take over arbitrary user accounts by changing their email and password without authentication. This includes administrator accounts, which can lead to full site compromise, data theft, and disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin and consider disabling or removing it if possible to prevent exploitation.