CVE-2024-8791
Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation
In short
A WordPress donation plugin allows anyone, without logging in, to change email addresses and passwords of any user account, including administrators. This lets attackers take over accounts and gain full control of the website.
Technical detail
The plugin fails to verify user identity in the update_core_user() function when processing the ID parameter, enabling unauthenticated attackers to modify email and password fields of arbitrary accounts via insecure direct object reference (IDOR). Successful exploitation leads to account takeover and administrative privilege escalation.
Summary generated and translated by AI from the official description.
The Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.8.1.14. This is due to the plugin not properly verifying a user's identity when the ID parameter is supplied through the update_core_user() function. This makes it possible for unauthenticated attackers to update the email address and password of arbitrary user accounts, including administrators, which can then be used to log in to those user accounts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
smub · Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & MoreWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.1.14/includes/users/class-charitable-user.php#L872https://plugins.trac.wordpress.org/changeset/3154009/charitable/trunk/includes/users/class-charitable-user.phphttps://www.wordfence.com/threat-intel/vulnerabilities/id/0ee60943-b583-4a99-8e62-846b380c98aa?source=cve