A critical (CVSS 9.8) SQL injection flaw in the Total Donations plugin for WordPress lets unauthenticated attackers extract sensitive data from the site database in all versions up to and including 2.0.5.
What Is It
CVE-2026-78568 is a SQL injection vulnerability (CWE-89) in KlbTheme's Total Donations plugin for WordPress. According to the NVD record, the plugin performs insufficient escaping on a user-supplied parameter and fails to adequately prepare an existing SQL query. That combination allows an attacker to append additional SQL statements onto queries the plugin already runs, and use them to extract sensitive information from the database.
The vulnerability was published on 2026-08-25 and is currently in "Received" status at NVD, with the record sourced from Wordfence.
Why It Matters
The CVSS 3.1 base score is 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Every exploitability factor is at its worst case: the attack is reachable over the network, requires low complexity, needs no privileges, and needs no user interaction. Impact is rated HIGH across confidentiality, integrity, and availability, giving a maximum exploitability subscore of 3.9.
Because no authentication is required, any internet-facing WordPress site running an affected version of the plugin is exposed to anonymous attackers. Database extraction on a donation platform implies exposure of whatever donor and site data the plugin's database holds.
There is no CISA KEV entry in the supplied source material for this CVE, so active exploitation is not confirmed by KEV at this time.
What's Vulnerable
- Vendor: KlbTheme
- Product: Total Donations (WordPress plugin)
- Affected versions: all versions from 0 through 2.0.5 inclusive (semver); default status for other versions is listed as unaffected
No CPE entries were provided in the NVD record.
Patch Status
The supplied NVD data lists no fixed version and no vendor advisory, and includes no CISA-mandated required action or remediation deadline. With 2.0.5, the latest version named in the record, marked affected and no patched release identified in the source material, defenders should consult the Patchstack and Wordfence references below for current mitigation guidance.