The WhyDonate WordPress plugin is vulnerable because it lacks a capability check when executing the remove_row function. This omission allows an unauthenticated attacker to send requests that delete rows from the plugin’s database table wp_wdplugin_style, which stores campaign style data. The result is a loss or alteration of campaign presentation settings, potentially disrupting fundraising pages and erasing configured styles. The weakness is classified as a missing authorization flaw (CWE‑862).

This weakness affects the WhyDonate – FREE Donate button – Crowdfunding – Fundraising plugin published by jjlemstra. All releases through and including version 4.0.15 are vulnerable. WordPress sites that have any of these versions installed are at risk. More recent releases beyond 4.0.15 are presumed fixed.

The CVSS base score is 5.3, indicating a moderate severity. The EPSS score of less than 1% indicates that, at the time of reporting, exploitation is considered unlikely, possibly because the attack requires unauthenticated HTTP requests to a non‑public endpoint. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by directly calling the remove_row endpoint via an unauthenticated request, provided the website has the plugin active. Therefore, while the risk is moderate, exploitation is limited to sites that have not applied the recent patch.