External risk intelligence

Total Donations Unauthenticated Privilege Escalation

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-73390

The vulnerability affects a WordPress plugin designed for processing donations. Such plugins are typically installed on public-facing web servers to facilitate external user interactions, transactions, and site functionality, making them commonly reachable via the internet.

Privilege Escalation

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified that allows for unauthenticated privilege escalation within the Total Donations software. This means an attacker could potentially gain elevated access to systems running this software without needing any prior credentials, impacting the integrity and confidentiality of operations. The primary concern at this time is to confirm if our environment utilizes this specific software.

Unauthenticated users can gain high system access.
Confirms relevance and exposure for potential impact.
Assess usage; remediate if affected.

Attack Path

How an attacker could exploit the issue

An attacker could target the Total Donations plugin by sending specially crafted requests to a website using a vulnerable version. This could allow an unauthenticated attacker to gain elevated privileges on the affected system.

No authentication required.
Triggered via crafted requests to the plugin.
Allows unauthenticated privilege escalation.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to escalate privileges on a system running Total Donations. This may lead to unauthorized access to sensitive information or the ability to modify system configurations, when supported by the advisory's conditions.

System and user data could be compromised.
Exposure could happen via network access.
Malicious code execution is a risk.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated privilege escalation vulnerability in Total Donations requires immediate attention from teams managing public-facing web applications. The first practical step is to identify all instances of the affected plugin, confirm its reachability and business criticality, and then assign ownership for remediation.

Own the issue: Application or website owners.
Verify first: Plugin reachability and business criticality.
Follow-up action: Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Total Donations plugin?

Total Donations is a WordPress plugin used by website administrators to manage and process charitable contributions. It integrates directly into WordPress sites, allowing visitors to make payments or donations through the site's interface. Because it handles financial data and user interactions, it is commonly installed on web servers that must remain accessible to the public internet to function effectively.

What does CWE-266 mean for CVE-2026-73390?

CWE-266 refers to Incorrect Privilege Assignment. In the context of this vulnerability, it means the plugin fails to properly restrict access rights, allowing an unauthorized user to gain administrative-level capabilities. Instead of verifying who a user is before granting access to sensitive functions, the software mistakenly elevates their permissions, effectively bypassing the security controls that should protect the system.

How is this privilege escalation triggered?

An attacker triggers this vulnerability by sending specifically crafted network requests to a website that has the affected version of the Total Donations plugin installed. Because the flaw exists in how the plugin handles these requests, no prior login or valid user account is needed. Notably, simply visiting the site normally or browsing standard pages does not trigger the bug; it requires the deliberate transmission of malicious data packets designed to exploit the plugin's logic.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal flags this as likely relevant because Total Donations is designed to be public-facing. Since the plugin is meant to facilitate external transactions, it is almost always reachable via the internet. If your server is connected to the public web, it is accessible to potential attackers, meaning they do not need internal network access to attempt to send the crafted requests that trigger this privilege escalation.

What should I do if I use Total Donations?

Your first step is to locate every instance of the Total Donations plugin within your web environment. Once identified, confirm the specific version running to see if it is 2.0.5 or older. After assessing where it is used and whether the site is business-critical, coordinate with your technical team to restrict access or apply available updates to neutralize the escalation risk.

References

patchstack.com/database/wordpress/plugin/totaldonations/vulnerabilit…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.