CVE-2026-16650 — Charitable < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass
The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated att…
Published: 2026-08-21 · CVSS: 5.3 · CVSS 3.1
The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7