What is the CVSS score of CVE-2025-10186?

CVE-2025-10186 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

WordPress CVE-2025-10186

MEDIUM

Missing Authorization (CWE-862)

2025-10-15 security@wordfence.com

Authentication Bypass WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 18:38 vuln.today

CVE Published

Oct 15, 2025 - 09:15 nvd

MEDIUM 5.3

DescriptionCVE.org

The WhyDonate - FREE Donate button - Crowdfunding - Fundraising plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the remove_row function in all versions up to, and including, 4.0.15. This makes it possible for unauthenticated attackers to delete rows from the wp_wdplugin_style table.

AnalysisAI

Unauthenticated attackers can delete rows from the wp_wdplugin_style database table in the WhyDonate WordPress plugin (versions up to 4.0.15) due to a missing capability check on the remove_row function. This allows unauthorized modification of site styling configuration without authentication, impacting data integrity for affected WordPress installations. No public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

The WhyDonate plugin for WordPress implements a remove_row function that lacks proper WordPress capability checks (nonce validation and user role verification). The vulnerability stems from CWE-862 (Missing Authorization), where the function fails to verify that the requesting user has administrative privileges before processing deletion requests. The wp_wdplugin_style table stores plugin styling configuration, and direct manipulation via unauthenticated requests allows arbitrary row deletion. WordPress plugins must implement wp_verify_nonce() and current_user_can() checks before processing state-changing operations; this plugin omits these controls entirely.

Affected ProductsAI

WhyDonate - FREE Donate button - Crowdfunding - Fundraising plugin for WordPress, versions 4.0.15 and earlier. The plugin is distributed via the official WordPress plugin repository at https://wordpress.org/plugins/wp-whydonate/. The vulnerability affects all installations with these versions active in their WordPress environment.

RemediationAI

Update the WhyDonate plugin to version 4.0.16 or later immediately, as the vendor has released a patched version addressing the missing capability check. WordPress administrators should navigate to their WordPress admin dashboard, select Plugins > Installed Plugins, locate WhyDonate, and click the update button if available. If automatic updates are not configured, manual update can be performed via the Plugins menu or by downloading the latest version from https://wordpress.org/plugins/wp-whydonate/ and uploading it via SFTP. No documented workaround exists for earlier versions; patching is the primary remediation path. Verify the update by checking the plugin version in Plugins > Installed Plugins after restart.