The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin is vulnerable to SQL Injection through the 's' parameter in versions up to 1.8.10.4. The vulnerability arises from improper neutralization of special elements in SQL commands (CWE-89), specifically due to insufficient escaping of user-supplied input and lack of prepared statements. Authenticated attackers with the edit_others_donations capability can append arbitrary SQL queries to existing ones, potentially extracting sensitive data from the database. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No patch or official remediation level is currently documented.

An attacker with authenticated access to the donation management admin area and the edit_others_donations capability can exploit this vulnerability to extract sensitive information from the database by injecting SQL commands. This compromises confidentiality but does not affect data integrity or availability. The vulnerability does not allow unauthenticated exploitation and requires specific privileges, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to users with the edit_others_donations capability and monitor for suspicious activity related to the 's' parameter in the donation management admin area. Avoid granting unnecessary privileges to users. Do not rely on generic mitigations as the vulnerability specifically involves SQL injection via a particular parameter.