The CVE identifies a missing authorization flaw in the Foysal Imran IDonate WordPress plugin, allowing attackers to exploit incorrectly configured access control security levels. This weakness can let unauthorized users elevate privileges, potentially accessing or modifying content, settings, or data that should be restricted to authenticated or privileged users.

Systems running the WordPress IDonate plugin version 2.1.15 or earlier are affected. The vendor product is the IDonate plugin by Foysal Imran, and the issue is applicable to all installations using the plugin with this or older versions.

The vulnerability has a CVSS score of 5.3, indicating moderate severity. The EPSS score is less than 1%, suggesting a low probability of widespread exploitation at this time. It is not listed in the CISA KEV catalog. The likely attack vector is via web requests to the plugin’s administrative endpoints, where the missing authorization check allows privilege escalation. Given the moderate score and low exploitation probability, the risk to a mitigated environment is moderate but still warrants timely action.