CVE-2026-78568: 
WordPress vulnerability analysis and mitigation

CVE-2026-78568 is a critical SQL Injection vulnerability in the Total Donations plugin for WordPress, affecting all versions up to and including 2.0.5. The flaw stems from insufficient escaping of user-supplied parameters and inadequate preparation of existing SQL queries, enabling unauthenticated attackers to append malicious SQL into existing queries and extract sensitive data from the database. It was published on August 25, 2026, with Wordfence as the assigning CNA. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (Wordfence, Github Advisory).

The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), arising from the plugin's failure to properly escape user-supplied input before incorporating it into SQL queries and its lack of prepared statements or parameterized queries. An unauthenticated remote attacker can craft HTTP requests with malicious SQL payloads targeting vulnerable plugin endpoints, appending additional SQL clauses to existing queries. No authentication or user interaction is required, and the attack can be executed over the network with low complexity. No public proof-of-concept exploit code has been identified at this time (Wordfence, Patchstack).

Successful exploitation allows unauthenticated attackers to extract sensitive information from the WordPress database, potentially including user credentials, personal data, configuration details, and other stored records. The CVSS scoring reflects high impacts to confidentiality, integrity, and availability, meaning attackers could not only read but potentially modify or delete database content. Compromised WordPress credentials could enable further lateral movement, including administrative account takeover and full site compromise (Github Advisory, Patchstack).

No public proof-of-concept exploit code has been identified, and there is no confirmed evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting WordPress plugins at scale, regardless of site popularity (Patchstack, Feedly).

1. Reconnaissance: Identify WordPress sites running the Total Donations plugin (version ≤ 2.0.5) using tools such as WPScan, Shodan, or Google dorks targeting plugin-specific file paths (e.g., inurl:/wp-content/plugins/totaldonations/).
2. Identify vulnerable endpoint: Locate the plugin's front-end or AJAX-accessible endpoints that accept user-supplied parameters passed into SQL queries without proper sanitization.
3. Craft SQL injection payload: Construct a malicious HTTP request (GET or POST) that appends additional SQL clauses to the existing query via the vulnerable parameter — for example, using UNION-based or time-based blind injection techniques.
4. Extract database contents: Use the injected SQL to enumerate database tables, extract WordPress user table credentials (wp_users), or retrieve other sensitive records such as donation data or configuration values.
5. Escalate access: Use extracted administrator credentials to log into the WordPress dashboard and achieve full site compromise, including remote code execution via plugin/theme file editing (Wordfence, Patchstack).

• Network: Unusual HTTP requests to Total Donations plugin endpoints containing SQL metacharacters (e.g., ', --, UNION, SELECT, OR 1=1) in query parameters; repeated requests from a single IP to plugin-specific URLs.
• Logs: WordPress or web server access logs showing requests to plugin endpoints with encoded or obfuscated SQL syntax; anomalous database query errors in PHP/MySQL error logs.
• File System: Unexpected new admin accounts in the WordPress database (wp_users table); unauthorized changes to plugin or theme files that could indicate post-exploitation activity.
• Process/Application: Sudden appearance of new WordPress administrator accounts not created through normal registration flows; unexpected changes to site content or settings following suspicious request activity (Wordfence).

No official patch from the plugin developer has been confirmed as of the disclosure date; the Patchstack advisory notes no official patch is available and the plugin remains at version 2.0.5. Patchstack has issued a virtual patching/mitigation rule for subscribers to block exploitation attempts until an official fix is released. Administrators should immediately deactivate and remove the Total Donations plugin if a patched version is unavailable, implement a Web Application Firewall (WAF) with SQL injection detection rules, and monitor for suspicious database activity. When a patched version becomes available, upgrading immediately is the recommended long-term remediation (Patchstack, Wordfence).

The vulnerability was reported by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity and disclosed via Patchstack on August 19, 2026, with the CVE formally published by Wordfence on August 25, 2026. Patchstack flagged it as high priority, warning that SQL injection vulnerabilities in WordPress plugins are commonly leveraged in mass-exploit campaigns. Social media activity was observed on Mastodon and Infosec.exchange shortly after disclosure, consistent with routine community awareness sharing for newly published WordPress plugin CVEs (Patchstack).