Medium severity5.3NVD Advisory· Published Apr 7, 2026· Updated Apr 27, 2026
CVE-2026-3177
CVE-2026-3177
Description
The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions up to, and including, 1.8.9.7. This is due to missing cryptographic verification of incoming Stripe webhook events. This makes it possible for unauthenticated attackers to forge payment_intent.succeeded webhook payloads and mark pending donations as completed without a real payment.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2News mentions
3- Musk v. Altman: A Warning for Enterprise AIGovInfoSecurity · May 17, 2026
- Worries About AI’s Risks to Humanity Loom Over the Trial Pitting Musk Against OpenAI’s LeadersSecurityWeek · May 7, 2026
- Wordfence Intelligence Weekly WordPress Vulnerability Report (April 6, 2026 to April 12, 2026)Wordfence Blog · Apr 16, 2026