External risk intelligence

Total Donations Plugin SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-78568

The vulnerability affects a WordPress plugin designed for processing donations. Such plugins are commonly deployed on public-facing web servers to accept contributions from internet users, making the vulnerable endpoint reachable via standard web traffic.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security flaw has been identified in the Total Donations plugin for WordPress, which could allow unauthorized access to sensitive data. This vulnerability exists because the plugin does not properly handle user input before using it in database queries.

Plugin flaw allows unauthorized data access.
Affects public-facing donation websites.
Confirm plugin relevance and exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to a WordPress site using the Total Donations plugin. The attacker would not need any special access to the website. The vulnerability lies in how the plugin handles user-supplied data before including it in a database query. When this data is not properly secured, an attacker can manipulate the query to access or modify sensitive information stored in the database.

No authentication required.
Manipulate database queries.
Sensitive information exposure.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated attackers could extract sensitive information from the database by injecting additional SQL queries into the Total Donations WordPress plugin. This is possible because the plugin does not sufficiently escape user-supplied parameters or properly prepare existing SQL queries.

Database information could be exposed.
Attackers could inject malicious SQL queries.
Sensitive data may be read by unauthorized parties.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Total Donations plugin for WordPress, with versions up to and including 2.0.5, is affected by a critical SQL injection vulnerability. This flaw allows unauthenticated attackers to extract sensitive database information by manipulating user-supplied parameters. Immediate action is required to identify and address this exposure, prioritizing systems that are internet-facing or handle critical data.

App owners must verify plugin usage.
Confirm internet reachability and data criticality.
Plan vendor-coordinated remediation or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Total Donations plugin for WordPress?

Total Donations is a WordPress plugin designed to help website owners manage and accept financial contributions from visitors. Because it facilitates transactions and collects donor details, it is commonly installed on sites that interact directly with the public, making it a critical component of a website's fundraising infrastructure.

What does SQL injection mean for CVE-2026-78568?

This vulnerability is classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. In plain terms, the plugin fails to clean user input before passing it to the database. This allows an attacker to insert their own database commands, effectively tricking the site into revealing sensitive data it should have kept private.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending specially crafted web requests to the site that the plugin processes. Because the flaw exists in how the plugin handles parameters, it does not require an attacker to have a user account or any prior authorization. Merely browsing the site normally will not trigger the bug; it requires specific, malicious input designed to exploit the poorly secured database query.

Why is this vulnerability a priority for my site?

According to Halo Surface Signal, this plugin is typically used on public-facing web servers. Since the vulnerability is reachable via standard internet traffic and requires no authentication, any site using an affected version is directly accessible to external attackers. If your server is reachable from the internet, the risk of unauthorized database access is significantly elevated.

Do I need to take immediate action for this CVE?

Yes, if you use the Total Donations plugin, you should immediately check your installation to see if you are running version 2.0.5 or earlier. Since this flaw allows for the extraction of sensitive information, you should prioritize confirming your plugin version and look for vendor updates. If an update is not yet available, consider disabling the plugin until you can secure the database connection.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.