CVE-2026-78568: Critical SQL Injection in WordPress Total Donations Plugin — Detection, Hunting, and Remediation Guide

---
title: CVE-2026-78568 Total Donations Plugin SQL Injection Attempt
id: 9c1f4e7a-2b3d-4f58-9a6c-7e2d1b8f0a45
status: experimental
description: Detects SQL injection payloads in HTTP requests targeting WordPress Total Donations plugin paths or admin-ajax.php with SQL metacharacters indicative of CVE-2026-78568 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-78568
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: apache
  service: access
detection:
  selection_plugin_path:
    cs-uri|contains:
      - '/wp-content/plugins/total-donations'
      - 'admin-ajax.php'
  selection_sqli_tokens:
    cs-uri-query|contains:
      - '%27'
      - 'union%20select'
      - 'union+select'
      - 'sleep('
      - 'benchmark('
      - 'extractvalue('
      - 'updatexml('
      - 'information_schema'
  condition: selection_plugin_path and selection_sqli_tokens
falsepositives:
  - Legitimate security scanning from authorized internal scanners (allowlist scanner IPs)
level: critical
---
title: WordPress Database Credential Extraction via SQLi Keywords
id: 3d8b2a1c-5f47-4e91-b6d2-0c9a3f7e5b18
status: experimental
description: Detects HTTP requests containing SQLi tokens combined with WordPress table names (wp_users, wp_options), indicating active database extraction attempts consistent with post-exploitation of plugin SQL injection vulnerabilities.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-78568
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_tables:
    cs-uri-query|contains:
      - 'wp_users'
      - 'wp_options'
      - 'user_pass'
      - 'user_login'
  selection_sqli:
    cs-uri-query|contains:
      - 'select'
      - 'union'
      - 'concat'
  condition: all of selection_*
falsepositives:
  - Authorized vulnerability assessments and penetration tests
level: high
---
title: Web Server Process Spawning Shell After SQLi Exploitation
id: 71a5c9e2-4d8b-4a3f-9c1e-2f6b8d0a5e37
status: experimental
description: Detects web server or PHP processes spawning command interpreters, a common post-exploitation behavior following SQL injection leading to credential theft or webshell deployment on WordPress hosts.
references:
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/httpd'
      - '/php-fpm'
      - '/nginx'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/curl'
      - '/wget'
  condition: all of selection_*
falsepositives:
  - Legitimate plugin or backup scripts invoked by PHP (rare; investigate before allowlisting)
level: high

// Hunt for CVE-2026-78568 SQLi exploitation attempts against Total Donations plugin
let sqliTokens = dynamic(["%27", "union select", "union+select", "sleep(", "benchmark(", "extractvalue(", "updatexml(", "information_schema", "wp_users", "user_pass"]);
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where RequestURL has_any ("admin-ajax.php", "total-donations", "wp-content/plugins")
| extend DecodedURL = url_decode(RequestURL)
| extend MatchedTokens = extract_all(@"(%27|'|union select|sleep\(|benchmark\(|extractvalue\(|updatexml\(|information_schema|wp_users|user_pass)", DecodedURL)
| where array_length(MatchedTokens) > 0
| summarize RequestCount = count(), SampleURLs = make_set(strcat(RequestMethod, " ", DecodedURL), 5) by SourceIP, DestinationHostName, bin(TimeGenerated, 1h)
| where RequestCount >= 2
| order by RequestCount desc;
// Correlate: suspicious DB-layer errors or high-volume queries from WordPress app servers via Syslog
Syslog
| where TimeGenerated > ago(14d)
| where ProcessName has_any ("mysqld", "mariadbd")
| where SyslogMessage has_any ("SQL syntax", "wp_users", "unauthenticated")
| summarize ErrorCount = count() by Computer, bin(TimeGenerated, 30m)
| where ErrorCount > 20;

-- Hunt for webshells and SQLi access-log evidence on WordPress hosts
-- 1) Recently modified PHP files under the Total Donations plugin directory (potential dropped webshells)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs='/var/www/**/wp-content/plugins/total-donations/**/*.php')
WHERE Mtime > now() - 1209600  -- modified within last 14 days
ORDER BY Mtime DESC;

-- 2) Access log entries with SQLi tokens targeting plugin/ajax endpoints
SELECT FullPath AS LogFile, Line
FROM foreach(row=glob(globs='/var/log/{apache2,nginx,httpd}/*access*.log'),
query={
  SELECT FullPath, Line
  FROM parse_lines(filename=FullPath, accessor='file')
  WHERE Line =~ 'admin-ajax\\.php|total-donations'
    AND Line =~ '(%27|union.{0,3}select|sleep\\(|benchmark\\(|information_schema|wp_users)'
});

#!/bin/bash
# CVE-2026-78568 — Total Donations plugin SQLi mitigation/verification
# Run as root or a user with read access to the WordPress installation.

WP_ROOT="${1:-/var/www/html}"
PLUGIN_DIR="$WP_ROOT/wp-content/plugins/total-donations"

echo "[*] Checking for Total Donations plugin under $WP_ROOT ..."

if [ ! -d "$PLUGIN_DIR" ]; then
  echo "[+] Plugin directory not found. Verify WP root path; host may not be affected."
  exit 0
fi

# Extract plugin version from the main plugin file header
VERSION=$(grep -ri "Version:" "$PLUGIN_DIR" --include="*.php" | head -1 | awk '{print $NF}' | tr -d '[:space:]')
echo "[!] Total Donations plugin detected. Installed version: ${VERSION:-unknown}"

# Versions <= 2.0.5 are vulnerable per CVE-2026-78568
if [ -n "$VERSION" ] && [ "$(printf '%s\n2.0.5\n' "$VERSION" | sort -V | head -1)" = "$VERSION" ]; then
  echo "[CRITICAL] Vulnerable version (<= 2.0.5) detected. Deactivating plugin..."
  if command -v wp >/dev/null 2>&1; then
    wp plugin deactivate total-donations --path="$WP_ROOT" --allow-root && echo "[+] Plugin deactivated via WP-CLI."
  else
    mv "$PLUGIN_DIR" "${PLUGIN_DIR}.disabled-$(date +%Y%m%d%H%M%S)" && echo "[+] WP-CLI unavailable; plugin directory renamed to disable it."
  fi
else
  echo "[+] Installed version appears newer than 2.0.5. Confirm against vendor advisory."
fi

# Review recent access logs for exploitation attempts
echo "[*] Scanning access logs (last 100k lines) for SQLi indicators..."
grep -hEi "total-donations|admin-ajax" /var/log/apache2/*access*.log /var/log/nginx/*access*.log 2>/dev/null \
  | tail -100000 \
  | grep -Ei "(%27|union.{0,3}select|sleep\(|benchmark\(|information_schema|wp_users|extractvalue\()" \
  | awk '{print $1}' | sort | uniq -c | sort -rn | head -20

echo "[*] Done. Any source IPs above should be treated as hostile: block, then pivot to IR scoping."