A security flaw has been found in the Total Donations plugin for WordPress, affecting all versions up to and including 2.0.5. This is a SQL injection vulnerability, which lets attackers sneak extra, unauthorized database commands into the queries the plugin already runs. This flaw can be exploited by anyone, even people who do not have login access to your website. If attackers take advantage of this issue, they could extract sensitive information stored in your site's database, such as donor records, user details, or other private data you keep on your site.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-78568
