CVE-2026-16650 — Charitable < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass

CVE-2026-16650

Charitable < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass PUBLISHED

Description (CNA)

The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment.

Affected (CNA)

Vendor / product	Versions
Unknown / Charitable	affected 0 before 1.8.12

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/da611bd1-0702-4cdd-b04c-ad7210f78cfe/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.