CVE-2019-6703

This vulnerability is like a “door that shouldn’t open” in your WordPress donation plugin. An attacker who reaches your site can use that door to change important settings, including settings that can create an administrator account. If they succeed, they can take over your site and redirect, deface, or manipulate donation features.

This matters if you run WordPress and have the plugin “Total Donations” from Calmar Webmedia installed at a version up to and including 2.0.5. Because the flaw can be triggered by outsiders (unauthenticated), it’s relevant even if you don’t give attackers any credentials. The risk is highest when the affected site is reachable from the internet and the plugin is installed and active (because the vulnerable AJAX action can be called remotely).

Attackers have a working public exploit for this issue, so this is not just theoretical. Because the available information does not include a confirmed vendor patch, you should treat this as an urgent remediation item for any site running the affected plugin version. Given the AMBER verdict, prioritize disabling/removing the plugin and applying compensating controls as soon as possible rather than waiting for “routine maintenance.”