Total Donations - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/total-donations/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 25 Aug 2026 10:07:20 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSQL Injection Vulnerability in Total Donations WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-08-total-donations-sqli/Tue, 25 Aug 2026 10:07:20 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-total-donations-sqli/The Total Donations plugin for WordPress versions up to 2.0.5 is vulnerable to unauthenticated SQL injection, allowing attackers to extract sensitive database information.The Total Donations plugin for WordPress (up to and including version 2.0.5) contains a critical SQL injection vulnerability identified as CVE-2026-78568. The flaw exists due to insufficient input validation and a lack of parameterized queries when handling user-supplied parameters. This security deficiency allows unauthenticated remote attackers to append arbitrary SQL commands to existing database queries. Successful exploitation permits an attacker to perform unauthorized operations on the backend database, such as exfiltrating sensitive data, modifying application content, or disrupting service availability. Given the plugin's function, it is likely to be targeted for the extraction of donor or administrative information.

Attack Chain

  1. The attacker identifies a target WordPress site utilizing the Total Donations plugin version 2.0.5 or earlier.
  2. The attacker crafts an HTTP GET or POST request containing a malicious SQL payload targeted at an exposed parameter within the plugin's input fields.
  3. The request is transmitted to the web server hosting the vulnerable WordPress instance.
  4. The web application's input processing logic fails to properly sanitize or escape the attacker-supplied parameter.
  5. The plugin concatenates the malicious input directly into a database query string.
  6. The database engine executes the concatenated query, allowing the injected SQL commands to run with the privileges of the database user.
  7. The attacker iterates through database tables to exfiltrate sensitive data via boolean-based or union-based injection techniques.

Impact

Successful exploitation of CVE-2026-78568 can lead to the complete compromise of the site's database. This includes the potential theft of sensitive user data, donor information, and site configuration details. Given the critical CVSS score of 9.8, exploitation is unauthenticated and requires no user interaction, making it highly attractive for automated botnets scanning the web for vulnerable WordPress plugins.

Recommendation

  • Update the Total Donations plugin to the latest available version beyond 2.0.5 immediately to remediate CVE-2026-78568.
  • If an update is not immediately available, disable the plugin or restrict access to the affected web paths at the WAF level.
  • Monitor web server logs for HTTP requests containing common SQL injection characters (such as single quotes, semicolons, and comment indicators) targeting plugin-specific paths.
  • Deploy the provided Sigma rule to detect anomalous SQL injection patterns in web server logs.
]]>criticaladvisory