The WP Attractive Donations System - Easy Stripe & Paypal donations WordPress plugin suffers from an SQL Injection vulnerability (CVE-2026-28115) caused by improper neutralization of special elements in SQL commands. This allows unauthenticated remote attackers to perform Blind SQL Injection attacks, potentially exposing sensitive data. The vulnerability affects all versions up to 1.25. The CVSS 3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. No patch or vendor advisory is currently provided.

An attacker can exploit this vulnerability remotely without authentication to perform Blind SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive information from the database. The confidentiality impact is high, while integrity is not affected and availability impact is low. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the affected plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.