The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More contains an SQL Injection vulnerability (CWE-89) via the donation_ids parameter due to insufficient escaping and lack of prepared statements in all versions up to 1.8.8.4. Authenticated users with Subscriber-level privileges or above who have made a paid donation can append malicious SQL code to existing queries, potentially extracting sensitive data from the database. The CVSS 3.1 base score is 6.5 (medium), reflecting network attack vector, low attack complexity, and required privileges.

Successful exploitation allows an authenticated user with Subscriber-level access who has made a paid donation to extract sensitive information from the database. There is no indication of impact on data integrity or availability. The vulnerability does not require administrative privileges but does require a paid donation, limiting the attack surface somewhat.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided at this time. Until a patch is available, restrict Subscriber-level access and monitor for suspicious activity related to donation_ids parameter usage. Avoid granting paid donation privileges to untrusted users. Follow vendor updates closely for an official fix.