CVE-2025-49899

MediumCVSS 5.3

Published: 22/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

26th percentile - higher than 26% of all known CVEs

Summary

Missing Authorization vulnerability in jjlemstra Whydonate wp-whydonate allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Whydonate: from n/a through <= 4.0.15.

Risk Assessment

Unauthorized users may perform operations they are not permitted to, potentially leading to data integrity issues or unauthorized changes.

Recommendation

Update the Whydonate plugin to the latest patched version and configure proper access permissions.

Other vulnerabilities in Whydonate

CVE-2025-10186Medium
The WhyDonate – FREE Donate button – Crowdfunding – Fundraising plugin for WordPress (versions up to 4.0.15) has a missing capability check in the remove_row function, allowing unauthenticated attackers to delete rows from the wp_wdplugin_style table.

Original NVD description (English source)

Missing Authorization vulnerability in jjlemstra Whydonate wp-whydonate allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Whydonate: from n/a through <= 4.0.15.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS