CyberRota Analysis
AI-GeneratedThe Charitable WordPress plugin prior to version 1.8.12 is vulnerable due to its failure to verify the authenticity of incoming Square payment webhook events, enabling unauthenticated attackers to forge notifications that falsely mark donations as paid. This could lead to financial losses and undermine the integrity of donation tracking for organizations using the plugin. WordPress site administrators utilizing the Charitable plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment.