The Charitable WordPress plugin (versions prior to 1.8.12) has a critical vulnerability in its Square payment integration: the plugin does not verify webhook signatures, allowing attackers to forge donation notifications and create fraudulent donation records. This isn't a theoretical data integrity issue — it enables real economic fraud against organizations with limited security resources.
The attack works because the plugin accepts webhook notifications without validating Square's cryptographic signature. An attacker sends a forged HTTP POST to the plugin's webhook endpoint, and the donation gets recorded as paid without any actual payment being processed. Since there's no signature verification, there's no cryptographic proof the request came from Square — the plugin simply trusts the incoming data.
The downstream impact is severe. A forged $50,000 donation record doesn't just sit in a database — it flows into reporting tools, board presentations, and operational decisions. A charity that commits that nonexistent revenue to programs has suffered concrete economic harm even though no money ever changed hands. The vulnerability is exploitable by anyone with basic HTTP capabilities; no sophisticated infrastructure or access is required.
The CVSS 5.3 score is misleading because it measures technical integrity impact, not economic consequence. For charitable organizations with volunteer IT support and minimal fraud detection capability, this vulnerability sits at the exact intersection of high impact and low defensive capacity. The score may also contribute to deprioritization — a "medium" severity doesn't compel urgent action at organizations that already deprioritize patching.
On audit trails: the plugin records donations identically whether legitimate or forged. Without cross-referencing Square's own transaction logs against the WordPress database, a charity has no in-system evidence that a donation was fraudulent. Over time, as logs rotate and systems migrate, reconstructing whether historical donation data is trustworthy becomes increasingly difficult.
If you run Charitable with Square, upgrade to 1.8.12 immediately. For organizations that may have been compromised, pull Square's transaction logs and reconcile against your donation database — look for records where the payment processor has no corresponding transaction. Consider this reconciliation a necessary step even post-patch, because the fraud window may have been open long before this vulnerability was disclosed.