CVE-2026-81287: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Syed Balkhi Charitable

This vulnerability, identified as CWE-89, involves improper neutralization of special elements used in an SQL command within the Subscriber component of the Charitable plugin (<= 1.8.12.1). The flaw allows an attacker with network access and low privileges to execute crafted SQL commands, potentially leading to partial denial of service and confidentiality impact. The CVSS 3.1 base score is 8.5, reflecting high severity with network attack vector, low attack complexity, and no user interaction required. No known exploits in the wild or official remediation details have been published as of the data provided.

An attacker can exploit this SQL Injection vulnerability remotely with low complexity and no user interaction to cause partial denial of service and compromise confidentiality of data handled by the vulnerable Charitable plugin. The integrity impact is not indicated, but confidentiality and availability impacts are noted. This could lead to unauthorized access to sensitive subscriber data or disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor vendor communications for updates and consider restricting network access or privileges as a temporary measure.