PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10038 smub CVE debrief

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Insecure Direct Object Reference / Authorization Bypass leading to Arbitrary Attachment Deletion. This issue affects versions up to, and including, 1.8.11.1 and is exploitable via the profile avatar update flow. An authenticated attacker with Subscriber-level access and above can delete arbitrary attachments from the Media Library by performing a two-request chain: first poisoning the stored avatar meta value with a target attachment ID, then triggering deletion via a normal avatar upload.

Vendor
smub
Product
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-06
Original CVE updated
2026-07-23
Advisory published
2026-06-06
Advisory updated
2026-07-23

Who should care

Users of the Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin, particularly those with versions up to and including 1.8.11.1, should be aware of this vulnerability. Successful exploitation requires authenticated access at the Subscriber level or higher.

Technical summary

The vulnerability arises from the save_avatar() function in Charitable_Profile_Form calling wp_delete_attachment() on an attachment ID read from the user's 'avatar' meta without validating that the attachment is owned by the user. Additionally, Charitable_Data_Processor::process_picture() returns the raw posted value when no file is uploaded, allowing the 'avatar' user meta to be poisoned with any attacker-chosen attachment ID.

Defensive priority

MEDIUM

Recommended defensive actions

  • Update to a patched version of the Charitable plugin if available.
  • Restrict access to the Media Library and attachment management for users with Subscriber-level access and above.
  • Monitor Media Library for unauthorized changes.

Evidence notes

Evidence from Wordfence indicates that this vulnerability can be exploited through a two-request chain, allowing for arbitrary attachment deletion.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10038 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10038

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10038 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10038

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.10.5/includes/abstracts/abstract-class-charitable-form.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.10.5/includes/forms/class-charitable-profile-form.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.10.5/includes/forms/class-charitable-profile-form.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.10.5/includes/users/class-charitable-user.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.10.5/includes/utilities/class-charitable-data-processor.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.10/includes/abstracts/abstract-class-charitable-form.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.10/includes/forms/class-charitable-profile-form.php

    [email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.