The WP Attractive Donations System - Easy Stripe & Paypal donations WordPress plugin contains an SQL Injection vulnerability (CVE-2026-28115) caused by improper neutralization of special elements in SQL commands. This allows unauthenticated remote attackers to conduct Blind SQL Injection attacks, potentially leading to unauthorized data disclosure and partial denial of service. The affected versions are those up to and including 1.25. The vulnerability has a CVSS 3.1 score of 9.3, reflecting critical impact on confidentiality and some impact on availability, with no privileges or user interaction required for exploitation. No official patch or fix information is available from the vendor at this time.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information from the database (confidentiality impact) and partial denial of service (availability impact). The attack can be performed remotely without authentication or user interaction, making it highly dangerous. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or removing the affected plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once released.