The Double the Donation WordPress plugin up to version 2.0.0 contains a cross‑site request forgery flaw. An attacker can craft a request that is accepted by the plugin as if it came from an authenticated user, allowing the illicit execution of plugin‑specific actions. Because the flaw is a standard CSRF weakness – CWE‑352 – it can be exploited simply by getting a site visitor to load a crafted URL or submit a form that triggers the vulnerable endpoint. The result is that the attacker can alter donation settings, trigger unwanted donation submissions, or otherwise misuse the plugin’s functionality without permission.

WordPress sites using the Double the Donation plugin by kanwei, any installed version up through 2.0.0.

The vulnerability received a CVSS score of 4.3, indicating moderate severity. EPSS shows an exploitation probability of less than 1%, so the likelihood of a successful exploit is currently low. The issue is not listed in the CISA KEV catalog. With a standard CSRF attack surface, an attacker would need only to trick a legitimate user or place a malicious link on a trusted page to trigger the vulnerability, making it technically straightforward but not yet widely evidenced in the wild.