Broken Authentication in Leyka Donation Plugin Versions

CVE-2026-66677 represents a broken authentication vulnerability affecting Leyka, a popular WordPress donation plugin, in versions 3.32.3 and earlier. This vulnerability allows attackers to bypass subscriber authentication mechanisms, potentially gaining unauthorized access to user accounts and sensitive donation data. Organizations relying on Leyka for fundraising, charitable giving platforms, or membership-based donations face direct risk of account takeover, data theft, and reputational damage. The CVSS score of 7.6 (high) indicates significant impact, making this a critical patch priority for any WordPress installation using affected versions.

While this specific CVE lacks direct MITRE ATT&CK technique mappings, it falls squarely within authentication bypass attack patterns that Casky practitioners can detect through extended reasoning across multiple security skills. Practitioners using Casky would identify this vulnerability through skills mapping to CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and related techniques like T1556 (Modify Authentication Process), T1078 (Valid Accounts), and T1110 (Brute Force). When analyzing Leyka deployments, Casky's Claude-powered reasoning would flag authentication token validation weaknesses, session management flaws, and privilege escalation opportunities in findings reports. Practitioners would observe detection indicators including failed authentication attempts followed by successful access, unusual subscriber privilege elevation, and abnormal API authentication patterns—enabling rapid identification and remediation before exploitation occurs.