External risk intelligence

WordPress Total Donations Plugin Privilege Escalation Affects All Versions Through 2.0.5

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-78570

The vulnerability affects a WordPress plugin, which functions as a web-based application component. Such plugins are commonly installed on internet-facing websites to provide functionality to public users, making them a common part of the web-accessible attack surface.

Privilege Escalation

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Total Donations plugin for WordPress, allowing unauthenticated attackers to gain administrator privileges. This issue could potentially compromise the integrity and control of affected WordPress sites.

Unauthenticated users can become site administrators.
Protects against unauthorized site control.
Verify plugin usage and assess exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could potentially gain administrative access to a WordPress site by leveraging a flaw in the Total Donations plugin. This exposure allows them to directly interact with the vulnerable component without needing any prior login credentials. Once exploited, this could lead to significant compromise of the website's content and user data.

No login required.
Exploits a donations plugin.
Leads to administrator access.

Live Threat

Current exploitation, exposure, and threat context

The Total Donations plugin for WordPress is vulnerable to privilege escalation, potentially allowing unauthenticated attackers to gain administrator-level access. This means an attacker could take control of the WordPress site when supported by the advisory.

WordPress site data and control at risk.
Unauthenticated attackers could gain admin access.
Full site compromise is a realistic consequence.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Total Donations plugin for WordPress is affected by a critical privilege escalation vulnerability. This requires immediate attention from teams managing WordPress instances, potentially including web application owners, infrastructure teams, and security operations. The first practical step is to identify all WordPress sites utilizing this plugin, confirm their exposure and business criticality, and then assign ownership for remediation, which may involve vendor coordination or emergency patching.

WordPress application owners should own the issue.
Verify all WordPress sites using the plugin.
Plan vendor coordination and remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Total Donations plugin for WordPress?

Total Donations is a software component designed for WordPress sites to manage fundraising efforts, process monetary contributions, and track donor data. It integrates into the WordPress content management system to provide web-based tools for accepting and organizing financial gifts from visitors.

What does CVE-2026-78570 mean by Privilege Escalation?

This vulnerability, classified as Improper Privilege Management (CWE-269), occurs when a program does not properly verify a user's identity before granting elevated access. In this case, the plugin fails to enforce authentication boundaries, allowing an outsider to bypass standard login requirements and claim full administrator rights over the website.

How does an attacker trigger this vulnerability?

An attacker initiates this exploit by interacting directly with the vulnerable plugin's functions over the network. Because the flaw allows unauthenticated access, the trigger does not require the attacker to have an existing account, valid session, or any pre-approved permissions on the WordPress site.

Why does Halo Surface Signal categorize this as an external threat?

Halo Surface Signal flags this as an external risk because the Total Donations plugin is a web-based component typically installed on internet-facing websites. Since the plugin's purpose is to interact with the public, it exists on the visible attack surface, making it reachable by any remote actor with web access.

Do I need to take immediate action if I run this software?

Yes. First, perform an inventory to confirm which of your WordPress instances have this plugin active. Once identified, prioritize these sites for remediation by coordinating with the vendor for a security update or removing the plugin if it is not strictly necessary for your operations.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.