by Kastro
Paper/Archive/CVE-2024-8791

CVE-2024-8791

smub Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More — Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 54.4.544 × 2010.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.8.1.14. This is due to the plugin not properly verifying a user's identity when the ID parameter is supplied through the update_core_user() function. This makes it possible for unauthenticated attackers to update the email address and password of arbitrary user accounts, including administrators, which can then be used to log in to those user accounts.

Affected

ProductAffectedFixed inSource
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More≤ 1.8.1.14–CNA
charitable≤ 1.8.1.14–CISA-ADP

Scores by source

Wordfence (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/0ee60943-b583-4a99-8e62-846b380c98aa?source=cverefplugins.trac.wordpress.org/browser/charitable/tags/1.8.1.14/includes/users/class-charitable-user.php#L872refplugins.trac.wordpress.org/changeset/3154009/charitable/trunk/includes/users/class-charitable-user.php