CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The WhyDonate – FREE Donate button – Crowdfunding – Fundraising plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the remove_row function in all versions up to, and including, 4.0.15. This makes it possible for unauthenticated attackers to delete rows from the wp_wdplugin_style table.
Explanation of Vulnerability in Simple Terms
The WhyDonate plugin for WordPress versions 4.0.15 and earlier lacks proper authorization checks, allowing unauthenticated attackers to modify data on the site. An attacker can exploit this vulnerability without needing to log in or interact with a user. The vulnerability affects the plugin's core functionality and could lead to unauthorized changes to donation settings or related content.
What an attacker can do
Modify donation settings and related data without logging in.
Potential impact on your site
Attackers can alter donation configurations, potentially disrupting fundraising campaigns or redirecting funds.
Conditions required to exploit
Network access to the WordPress site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
