The vulnerability stems from a missing authorization check in the IDonatePro plugin, allowing an attacker to reach functionality that should be limited to privileged users. Because access control is incorrectly configured, an adversary could potentially modify donation settings, access sensitive payment information, or otherwise interfere with the plugin’s operations. The weakness is classified as CWE-862, indicating a flaw in access control enforcement.

The defect affects the ThemeAtelier IDonatePro WordPress plugin for all versions up to and including 2.1.9. Any WordPress site that has not yet migrated beyond this version range is potentially exposed.

The CVSS score of 7.5 signals a high severity, while the EPSS score of less than 1% suggests that exploitation is unlikely at this time. The vulnerability is not currently listed in CISA’s KEV catalog. Attackers would need to target the administrative interfaces of the plugin, typically via crafted web requests that bypass authentication checks. No public exploit has been documented, but the flaw remains present in a broad set of installations.