https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 01:48:00 +0000 https://cve.radiocsirt.org/vuln/cve-2026-10038 <p><strong>Affected:</strong> smub Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations &amp; More</p> <p>The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations &amp; More plugin for WordPress is vulnerable to Insecure Direct Object Reference / Authorization Bypass leading to Arbitrary Attachment Deletion in versions up to, and including, 1.8.11.1 via the profile avatar update flow. This is due to the save_avatar() function in Charitable_Profile_Form calling wp_delete_attachment() on an attachment ID read from the user&#39;s &#39;avatar&#39; meta without validating that the attachment is owned by the user, combined with Charitable_Data_Processor::process_picture() returning the raw posted value when no file is uploaded, allowing the &#39;avatar&#39; user meta to be poisoned with any attacker-chosen attachment ID. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary attachments from the Media Library by performing a two-request chain (first poisoning the stored avatar meta value with a target attachment ID, then triggering deletion via a normal avatar upload).</p> <p><strong>Affected:</strong> smub Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations &amp; More</p> <p>The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations &amp; More plugin for WordPress is vulnerable to Insecure Direct Object Reference / Authorization Bypass leading to Arbitrary Attachment Deletion in versions up to, and including, 1.8.11.1 via the profile avatar update flow. This is due to the save_avatar() function in Charitable_Profile_Form calling wp_delete_attachment() on an attachment ID read from the user&#39;s &#39;avatar&#39; meta without validating that the attachment is owned by the user, combined with Charitable_Data_Processor::process_picture() returning the raw posted value when no file is uploaded, allowing the &#39;avatar&#39; user meta to be poisoned with any attacker-chosen attachment ID. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary attachments from the Media Library by performing a two-request chain (first poisoning the stored avatar meta value with a target attachment ID, then triggering deletion via a normal avatar upload).</p> https://cve.radiocsirt.org/vuln/cve-2026-10038