CVE-2026-10038

Vulnerability

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Insecure Direct Object Reference / Authorization Bypass leading to Arbitrary Attachment Deletion in versions up to, and including, 1.8.11.1. This vulnerability exists within the profile avatar update flow, specifically in the save_avatar() function which calls wp_delete_attachment() without verifying ownership of the attachment ID [3]. The Charitable_Data_Processor::process_picture() function can return a raw posted value when no file is uploaded, allowing an attacker to poison the 'avatar' user meta with any attachment ID [3].

Exploitation

An authenticated attacker with at least Subscriber-level access can exploit this vulnerability. The attack requires a two-request chain. First, the attacker poisons the user's 'avatar' meta value with the ID of an arbitrary attachment they wish to delete. Second, the attacker triggers the normal avatar update process, which will then attempt to delete the attachment ID that was previously poisoned into the meta value [3].

Impact

Successful exploitation allows an attacker to delete arbitrary attachments from the WordPress Media Library. This can lead to the removal of important site assets, potentially disrupting site functionality or content. The attacker gains the ability to delete any attachment, regardless of who uploaded it or its association with other content.

Mitigation

The vulnerability was fixed in version 1.8.11.2 of the Charitable plugin. Users are advised to update to this version or later. No workarounds are available. The plugin is not listed on the Known Exploited Vulnerabilities (KEV) catalog.