The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details.

Source