CVE-2026-77189: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in smub Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)

CVE-2026-77189 describes an SQL Injection vulnerability in the Charitable – Donation & Fundraising Platform plugin for WordPress. The flaw exists in the handling of the 'order' shortcode attribute, where user-supplied input is not properly escaped or prepared before being included in SQL queries. This allows authenticated users with contributor-level permissions or higher to append malicious SQL commands to existing queries, potentially extracting sensitive database information. The attack vector involves the [charitable_donors] shortcode, which contributors can access via draft or pending post previews. No patch or official remediation guidance has been provided as of the published date.

An attacker with contributor-level access can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not allow privilege escalation or denial of service but compromises data confidentiality. The medium CVSS score (6.5) reflects the moderate risk due to the requirement for authenticated access and the potential impact on data confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and avoid exposing draft or pending post previews that include the [charitable_donors] shortcode. Monitor vendor channels for updates and apply patches promptly once released.