According to the Wordfence-assigned NVD record, a critical flaw (CVSS 9.8) in the Total Donations plugin for WordPress allows unauthenticated attackers to elevate their privileges to administrator on sites running version 2.0.5 or earlier. That characterization comes from the advisory itself; no independent confirmation or public proof-of-concept appears in the source material reviewed here.
What Is It
CVE-2026-78570 is a privilege escalation vulnerability in the Total Donations plugin for WordPress, published by KlbTheme. It is classified as CWE-269 (Improper Privilege Management). Per the NVD record, the plugin is vulnerable in all versions up to and including 2.0.5, and the flaw "makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator."
The CVE was assigned by Wordfence ([email protected]) and published on 2026-08-25. Its NVD status at the time of writing is "Received."
Why It Matters
The Wordfence-assigned CVSS 3.1 base score is 9.8 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Every exploitability factor is at its worst case:
- Network attack vector; reachable remotely over the internet
- Low attack complexity; no special conditions required
- No privileges required: attacker needs no account
- No user interaction: no admin has to click anything
Impact is HIGH across confidentiality, integrity, and availability. If the described escalation path holds, administrator access on a WordPress instance is effectively full control of the site and its content.
No CISA KEV entry was supplied for this CVE, so there is no confirmed active exploitation or federally mandated remediation deadline in the source material.
What's Vulnerable
- Vendor: KlbTheme
- Product: Total Donations (WordPress plugin)
- Affected versions: all versions from 0 through 2.0.5 inclusive (semver)
- Range metadata: the NVD record carries a default status of "unaffected" for versions outside the stated range. This is a structural default in the CVE data format, not a vendor statement that any specific later release has been fixed, 2.0.5 is the highest version named anywhere in the record.
No CPE identifiers were listed in the NVD record.
Patch Status
The supplied source material does not identify a fixed version. Because the vulnerability is reported to span every release up to and including 2.0.5, the latest version named in the record, administrators should treat the plugin as unpatched and consult the Patchstack and Wordfence advisories below for current mitigation guidance. The "unaffected" default noted above should not be read as evidence that a patched build exists; verify any candidate upgrade against the vendor advisory before relying on it. No CISA-required action or due date was provided.