Charitable <= 1.8.12.3 - Authenticated (Contributor+) Sensitive Information Exposure via 'charitable_campaign_preview' Parameter
- ID
- WPSEC-2026-0170
- Plugin
- Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) (charitable)
- Affected
- from 1.8.0 before 1.8.13
- Remediation
- Update to 1.8.13 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Charitable on WPSec AttackSurface
- Fix released
- Published
Description
The Charitable plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 1.8.0 up to, and including, 1.8.12.3. The campaign builder content template honoured the 'charitable_campaign_preview' query parameter for any visitor and rendered the builder preview data of whatever campaign ID it named. Its render gate also showed unpublished (draft) campaigns to any user with the site-wide edit_posts capability instead of checking edit rights on that campaign. This makes it possible for authenticated attackers, with Contributor-level access and above, to view other users' unpublished campaigns, including headlines, story text and images. Unauthenticated visitors could also view unsaved builder preview changes to published campaigns for 24 hours after a preview, and could have one campaign's content rendered under another campaign's URL.
References
- https://wpsec.com/vuln/WPSEC-2026-0170/
- https://plugins.svn.wordpress.org/charitable/tags/1.8.13/
- https://wordpress.org/plugins/charitable/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS