CVE-2025-10186

MediumCVSS 5.3

Published: 15/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

28th percentile - higher than 28% of all known CVEs

Summary

The WhyDonate – FREE Donate button – Crowdfunding – Fundraising plugin for WordPress (versions up to 4.0.15) has a missing capability check in the remove_row function, allowing unauthenticated attackers to delete rows from the wp_wdplugin_style table.

Risk Assessment

Unauthenticated attackers can delete data from the database table, potentially leading to data loss and disruption of plugin functionality.

Recommendation

Update the plugin to the latest version if available, and verify permissions in the code.

Other vulnerabilities in WhyDonate

CVE-2025-49899Medium
Missing Authorization vulnerability in jjlemstra Whydonate wp-whydonate allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Whydonate: from n/a through <= 4.0.15.

Original NVD description (English source)

The WhyDonate – FREE Donate button – Crowdfunding – Fundraising plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the remove_row function in all versions up to, and including, 4.0.15. This makes it possible for unauthenticated attackers to delete rows from the wp_wdplugin_style table.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS