Security Alert Summary
The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration. This can allow unauthenticated actors to submit forged webhook notifications that cause donations to be marked as paid without an actual payment.
CVE Details
- CVE ID: CVE-2026-16650
- Affected component: Charitable WordPress plugin (Square payment webhook handling)
- Affected versions: Versions less than 1.8.12
- Published: August 21, 2026 at 12:16 PM UTC
- Last modified: August 21, 2026 at 1:16 PM UTC
- CVSS v3.1: Base score 5.3, MEDIUM —
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Authentication / privileges / user interaction: No authentication required; privileges required: none; user interaction: none
- Impact: Confidentiality: None; Integrity: Low; Availability: None
- CWE / weakness ID: CWE-345
Technical Details
The vulnerability exists because, in its default configuration, the plugin does not verify the authenticity of incoming Square payment webhook events. Without verification of webhook signatures or another authenticity check, an unauthenticated attacker can craft webhook requests that the plugin accepts as legitimate.
The practical effect described is that forged webhook notifications can cause the plugin to mark donations as paid even though no actual payment occurred. The CVE description does not name specific functions or REST endpoints; it attributes the issue to missing verification of incoming Square webhook events in the default setup.
The impact is limited to integrity of the donation/payment state: financial records or donation status can be altered by forged notifications. There is no indication in the provided data of direct confidentiality or availability impacts beyond the change in payment status.
How This Could Impact Your Website
On a site using Charitable to process donations via Square, an attacker who can send HTTP requests to the webhook endpoint could submit fabricated payment notifications. In a realistic scenario, the site owner and internal staff may see donations marked as paid in the admin dashboard, while external contractors or contributors handling financial reconciliation may act on those records, issuing receipts or fulfilling donor-related actions based on incorrect status.
Consequences may include inaccurate financial records, issuance of donation receipts for payments that never occurred, and potential opportunities for social engineering or fraud related to donation processing. While this issue does not indicate direct data exposure, the presence of forged donation records can complicate bookkeeping and donor communications.
professional review If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and other non-administrative accounts with access to financial or donation management screens.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce overall attack surface.
- Monitor site activity and donation logs for unusual behavior or unexpected payment status changes.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
