A missing authorization flaw in the WP Attractive Donations System plugin allows an attacker who exploits improperly configured access controls to delete content without proper permissions. This weakness, identified as Missing Authorization (CWE-862), means that an attacker could remove any post, page, or donation entry, potentially disrupting the site’s data integrity and user experience.

The vulnerability affects the loopus WordPress plugin WP Attractive Donations System – Easy Stripe & Paypal donations, versions from an unspecified starting point up to and including 1.25. The plugin is listable under the vendor loopus in WordPress installations.

The CVSS score of 7.5 indicates a high impact severity, yet the EPSS score of less than 1% points to a low likelihood of exploitation in the wild, and the flaw is not currently listed in the CISA KEV catalog. Based on the description it is inferred that the attack vector would involve a user with compromised or misconfigured administrative privileges, or an attacker who has gained access to the WordPress admin area through other credentials. No public exploit code is documented, so the risk remains moderate to high depending on the security posture.