CVE-2024-8791criticalCWE-639

CVE-2024-8791: critical vulnerability in smub Charitable – Donation Plugin for…

Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation

Published · Updated

Follow this CVE+ Monitor Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 0.7%
In short

A WordPress donation plugin allows anyone, without logging in, to change email addresses and passwords of any user account, including administrators. This lets attackers take over accounts and gain full control of the website.

Technical detail

The plugin fails to verify user identity in the update_core_user() function when processing the ID parameter, enabling unauthenticated attackers to modify email and password fields of arbitrary accounts via insecure direct object reference (IDOR). Successful exploitation leads to account takeover and administrative privilege escalation.

Summary generated and translated by AI from the official description.
The Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.8.1.14. This is due to the plugin not properly verifying a user's identity when the ID parameter is supplied through the update_core_user() function. This makes it possible for unauthenticated attackers to update the email address and password of arbitrary user accounts, including administrators, which can then be used to log in to those user accounts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
smub · Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
Related CVEs — smub Charitable – Donation Plugin for…

In the same product, most dangerous first.

CVE-2023-4404CRITICALDonation Forms by Charitable <= 1.7.0.12 - Unauthenticated Privilege EscalationEPSS 0.9%CVE-2024-10876MEDIUMCharitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.3 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2025-11893MEDIUMCharitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.8.4 - Authenticated (Subscriber+) SQL InjectionEPSS 0.4%CVE-2026-10038MEDIUMCharitable <= 1.8.11.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via 'avatar' ParameterEPSS 0.3%CVE-2026-7619MEDIUMCharitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search ParameterEPSS 0.3%CVE-2025-5275MEDIUMCharitable <= 1.8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy SettingsEPSS 0.2%