CVE-2026-16650CWE-345

CVE-2026-16650

Medium · published August 21, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
5.2
In the wild
Unconfirmed
What it is

The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00163 · 5.2th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2026-08-21T16:16Z
References (1)
https://wpscan.com/vulnerability/da611bd1-0702-4cdd-b04c-ad7210f78cfe/ · [email protected]
EPSS history
Timeline
  • 21 AUG 11:40Z
    Charitable < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass
    cvelistv5