CVE-2026-3177

MEDIUM5.3

Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhook

Published Apr 7, 2026

Modified 2 weeks ago

Details

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions up to, and including, 1.8.9.7. This is due to missing cryptographic verification of incoming Stripe webhook events. This makes it possible for unauthenticated attackers to forge payment_intent.succeeded webhook payloads and mark pending donations as completed without a real payment.

References

WEB

https://plugins.trac.wordpress.org/changeset/3485023/charitable

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-3177

WEB

https://www.wordfence.com/threat-intel/vulnerabilities/id/bc3b2645-7b57-4884-99c5-e37dbd4a9600?source=cve

CVSS Analysis

CVSS v3.1

5.3

Exploitability

Attack Vector