CVE-2026-3177: medium-severity vulnerability in smub Charitable – Donation Plugin for…
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhook
Published · Updated
Follow this CVE+ Monitor Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.2%
The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions up to, and including, 1.8.9.7. This is due to missing cryptographic verification of incoming Stripe webhook events. This makes it possible for unauthenticated attackers to forge payment_intent.succeeded webhook payloads and mark pending donations as completed without a real payment.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
smub · Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & MoreRelated CVEs — smub Charitable – Donation Plugin for…
In the same product, most dangerous first.
CVE-2023-4404CRITICALDonation Forms by Charitable <= 1.7.0.12 - Unauthenticated Privilege EscalationEPSS 0.9%CVE-2024-8791CRITICALDonation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege EscalationEPSS 0.7%CVE-2024-10876MEDIUMCharitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.3 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2025-11893MEDIUMCharitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.8.4 - Authenticated (Subscriber+) SQL InjectionEPSS 0.4%CVE-2026-10038MEDIUMCharitable <= 1.8.11.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via 'avatar' ParameterEPSS 0.3%CVE-2026-7619MEDIUMCharitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search ParameterEPSS 0.3%