The vulnerability identified as CVE-2026-73391 is an SQL Injection (CWE-89) in KlbTheme's Total Donations plugin, affecting all versions up to and including 2.0.5. It can be exploited without authentication, allowing an attacker to inject malicious SQL commands. The CVSS 3.1 base score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact.

Successful exploitation can lead to unauthorized disclosure of sensitive data due to the high confidentiality impact. The vulnerability does not affect data integrity but may cause limited availability issues. Since no authentication is required, the attack surface is broad, increasing risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for unusual database activity. Avoid exposing vulnerable versions to untrusted networks.