CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionNVD
The WhyDonate - FREE Donate button - Crowdfunding - Fundraising plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the remove_row function in all versions up to, and including, 4.0.15. This makes it possible for unauthenticated attackers to delete rows from the wp_wdplugin_style table.
AnalysisAI
Unauthenticated attackers can delete rows from the wp_wdplugin_style database table in the WhyDonate WordPress plugin (versions up to 4.0.15) due to a missing capability check on the remove_row function. This allows unauthorized modification of site styling configuration without authentication, impacting data integrity for affected WordPress installations. No public exploit code or active exploitation has been confirmed at the time of analysis.
Technical ContextAI
The WhyDonate plugin for WordPress implements a remove_row function that lacks proper WordPress capability checks (nonce validation and user role verification). The vulnerability stems from CWE-862 (Missing Authorization), where the function fails to verify that the requesting user has administrative privileges before processing deletion requests. The wp_wdplugin_style table stores plugin styling configuration, and direct manipulation via unauthenticated requests allows arbitrary row deletion. WordPress plugins must implement wp_verify_nonce() and current_user_can() checks before processing state-changing operations; this plugin omits these controls entirely.
Affected ProductsAI
WhyDonate - FREE Donate button - Crowdfunding - Fundraising plugin for WordPress, versions 4.0.15 and earlier. The plugin is distributed via the official WordPress plugin repository at https://wordpress.org/plugins/wp-whydonate/. The vulnerability affects all installations with these versions active in their WordPress environment.
RemediationAI
Update the WhyDonate plugin to version 4.0.16 or later immediately, as the vendor has released a patched version addressing the missing capability check. WordPress administrators should navigate to their WordPress admin dashboard, select Plugins > Installed Plugins, locate WhyDonate, and click the update button if available. If automatic updates are not configured, manual update can be performed via the Plugins menu or by downloading the latest version from https://wordpress.org/plugins/wp-whydonate/ and uploading it via SFTP. No documented workaround exists for earlier versions; patching is the primary remediation path. Verify the update by checking the plugin version in Plugins > Installed Plugins after restart.
Share
External POC / Exploit Code
Leaving vuln.today