WordPress Plugin Vulnerabilities
WhyDonate – FREE Donate button – Crowdfunding – Fundraising < 4.0.16 - Missing Authorization to Unauthenticated wp_wdplugin_style Rww Deletion
Description
The WhyDonate – FREE Donate button – Crowdfunding – Fundraising plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the remove_row function in all versions up to, and including, 4.0.15. This makes it possible for unauthenticated attackers to delete rows from the wp_wdplugin_style table.
Affects Plugins
Fixed in 4.0.16 References
Classification
Type
NO AUTHORISATION
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Jonas Benjamin Friedli
Verified
No
WPVDB ID
Timeline
Publicly Published
2025-10-14 (about 1 year ago)
Added
2025-10-14 (about 1 year ago)
Last Updated
2025-10-17 (about 11 months ago)
