CVE-2026-10038
Deferred Deferred - Pending Action
Authorization Bypass Leads to Arbitrary Attachment Deletion in Charitable WordPress Plugin

Publication date: 2026-06-06

Last updated on: 2026-06-08

Assigner: Wordfence

Description
The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Insecure Direct Object Reference / Authorization Bypass leading to Arbitrary Attachment Deletion in versions up to, and including, 1.8.11.1 via the profile avatar update flow. This is due to the save_avatar() function in Charitable_Profile_Form calling wp_delete_attachment() on an attachment ID read from the user's 'avatar' meta without validating that the attachment is owned by the user, combined with Charitable_Data_Processor::process_picture() returning the raw posted value when no file is uploaded, allowing the 'avatar' user meta to be poisoned with any attacker-chosen attachment ID. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary attachments from the Media Library by performing a two-request chain (first poisoning the stored avatar meta value with a target attachment ID, then triggering deletion via a normal avatar upload).
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-06
Last Modified
2026-06-08
Generated
2026-06-27
AI Q&A
2026-06-06
EPSS Evaluated
2026-06-25
NVD
CVE-2026-10038
EUVD
EUVD-2026-34927
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
charitable charitable to 1.8.11.1 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The Charitable – Donation Plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) and Authorization Bypass issue that allows arbitrary deletion of attachments. This happens because the plugin's save_avatar() function deletes an attachment based on an attachment ID stored in the user's 'avatar' meta without verifying if the user owns that attachment. An attacker can manipulate the 'avatar' meta to contain any attachment ID, enabling them to delete arbitrary files from the Media Library by performing two requests: first, poisoning the avatar meta with a target attachment ID, then triggering the deletion via a normal avatar upload.

Impact Analysis

This vulnerability allows authenticated users with Subscriber-level access or higher to delete any attachment in the WordPress Media Library, not just their own. This could lead to loss of important media files, disruption of website content, and potential damage to the site's integrity and user experience.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-10038. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart