medium5.3
CVE-2026-16650
The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing u…
Impact
The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment.
Affected products
| Product | Affected versions |
|---|---|
| Charitable WordPress Plugin | before 1.8.12 |
Versions were read from the advisory text. No structured product data has been published for this record yet.