CVE-2026-78568— Total Donations <= 2.0.5 - Unauthenticated SQL Injection
Quick assessment
Affected
KlbTheme Total Donations
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 的 Total Donations 插件在所有版本中，直至且包括 2.0.5 版本，都存在 SQL 注入漏洞。该漏洞是由于对用户提供的参数缺乏足够的转义处理，以及在现有 SQL 查询中缺乏足够的预处理造成的。这使得未经身份验证的攻击者能够将额外的 SQL 查询附加到现有查询中，从而用于从数据库中提取敏感信息。
Possible ATT&CK Techniques 2 AI
T1005 · Data from Local System T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-78568
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Total Donations <= 2.0.5 - Unauthenticated SQL Injection
Source: CVE Program / CVE List V5
Vulnerability Description
The Total Donations plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| KlbTheme | Total Donations | 0 ~ 2.0.5 | - |
|
II. Public POCs for CVE-2026-78568
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-78568
请登录查看更多情报信息。
News Coverage for CVE-2026-78568 (2)
IV. Related Vulnerabilities
Same product: Total Donations
-
CVE-2026-78570
Total Donations <= 2.0.5 - Unauthenticated Privilege Escalat -
CVE-2026-73390
WordPress Total Donations plugin <= 2.0.5 - Privilege Escala -
CVE-2026-73391
WordPress Total Donations plugin <= 2.0.5 - SQL Injection vu -
CVE-2025-43837
WordPress Total Donations <= 3.0.8 - Cross Site Scripting (X
Same vendor: KlbTheme
-
CVE-2026-78570
Total Donations <= 2.0.5 - Unauthenticated Privilege Escalat -
CVE-2026-73390
WordPress Total Donations plugin <= 2.0.5 - Privilege Escala -
CVE-2026-73391
WordPress Total Donations plugin <= 2.0.5 - SQL Injection vu -
CVE-2023-49186
WordPress Machic Core plugin <= 1.2.6 - Reflected Cross Site -
CVE-2023-49838
Cross-Site Request Forgery (CSRF) vulnerability in multiple
Same weakness: CWE-89
-
CVE-2026-78576
Readabler < 2.0.18 - Unauthenticated SQL Injection -
CVE-2026-77137
SQL Injection in extension "Forms Export" (frp_form_answers) -
CVE-2026-78656
itsourcecode Sales and Inventory System cust_del.php sql inj -
CVE-2026-78470
WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+ -
CVE-2026-15023
Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL I
V. Comments for CVE-2026-78568
No comments yet