CVE-2026-16650: 
WordPress vulnerability analysis and mitigation

CVE-2026-16650 is a webhook signature bypass vulnerability in the Charitable WordPress plugin that allows unauthenticated attackers to forge Square payment webhook notifications, marking donations as paid without any actual payment being made. It affects all versions of the Charitable plugin before 1.8.12 and was publicly disclosed on August 14, 2026, with the CVE record published on August 21, 2026. The vulnerability was discovered and reported by researcher Muni Nitish Kumar Yaddala. It carries a CVSS v3.1 base score of 5.3 (Medium), assigned by WPScan (WPScan, Github Advisory).

The root cause is classified as CWE-345 (Insufficient Verification of Data Authenticity): in its default configuration, the Charitable plugin does not validate the cryptographic signature of incoming Square payment webhook events, meaning any HTTP request crafted to resemble a Square webhook can be accepted as legitimate. An unauthenticated attacker can send a forged POST request to the plugin's webhook endpoint, mimicking a successful payment notification from Square, which causes the plugin to update the donation status to "paid" without any real transaction occurring. No authentication, special privileges, or user interaction is required, and the attack is fully automatable over the network (WPScan, Github Advisory).

Successful exploitation allows an attacker to fraudulently mark donations as paid in the WordPress site's database without transferring any real funds, directly causing financial loss to organizations relying on the Charitable plugin for donation collection. The integrity of donation records is compromised, as attackers can generate arbitrary "paid" donation entries. There is no confidentiality or availability impact — the vulnerability is limited to data integrity within the donation payment workflow (WPScan, Github Advisory).

As of the disclosure date, there is no public proof-of-concept exploit available; WPScan has indicated a PoC will be published on August 28, 2026, to allow time for users to update. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. However, the attack is rated as automatable by CISA-ADP, meaning it could be trivially scripted at scale once a PoC is released (WPScan, Github Advisory).

1. Reconnaissance: Identify WordPress sites using the Charitable plugin (versions before 1.8.12) via passive scanning, WordPress plugin enumeration tools (e.g., WPScan CLI), or by inspecting publicly visible plugin metadata in page source.
2. Locate the webhook endpoint: Identify the URL registered by the Charitable plugin to receive Square payment webhook events (typically a WordPress REST API or admin-ajax endpoint configured during Square payment setup).
3. Craft a forged webhook payload: Construct an HTTP POST request that mimics a legitimate Square payment completion webhook, including the expected JSON body fields (e.g., type: payment.completed, donation ID, amount) without a valid Square webhook signature header.
4. Send the forged request: Submit the crafted POST request to the webhook endpoint. Because the plugin does not verify the webhook signature in its default configuration, it accepts the request as authentic.
5. Observe the result: The targeted donation record in the WordPress database is updated to a "paid" status, with no real payment having been processed (WPScan).

• Network: Unexpected POST requests to the Charitable plugin's Square webhook endpoint originating from IP addresses not associated with Square's infrastructure; high-frequency or repeated webhook calls from a single source.
• Logs: WordPress access logs showing POST requests to the webhook handler URL with missing or invalid Square-Signature (or equivalent) headers; requests arriving outside of normal donation activity patterns.
• Database: Donation records marked as "paid" with no corresponding transaction ID in Square's payment dashboard; donations with amounts or donor details inconsistent with legitimate submissions.
• Application: Discrepancies between the number of "paid" donations in the Charitable plugin and actual funds received in the connected Square account (WPScan).

Site administrators should upgrade the Charitable WordPress plugin to version 1.8.12 or later, which addresses the webhook signature verification gap. As a temporary workaround prior to patching, administrators can implement server-level controls (e.g., firewall rules or WAF policies) to restrict access to the webhook endpoint to Square's known IP ranges, or manually enable webhook signature validation using Square's signing keys if the plugin provides that configuration option. Regularly reconciling donation records in the Charitable plugin against actual transactions in the Square dashboard can help detect fraudulent entries (WPScan, Github Advisory).