PT-2025-43171 · Jjlemstra · Whydonate

Legion Hunter · Published 2025-10-22 · Updated 2025-11-18 · CVE-2025-49899

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Whydonate versions through 4.0.15

Description A missing authorization flaw exists in Whydonate, potentially allowing access to functionality that should be restricted by Access Control Lists (ACLs). This could allow unauthorized access to certain features or data within the application.

Recommendations Update Whydonate to a version later than 4.0.15.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-49899

Affected Products

Whydonate

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-49899 · Security Note
• https://vdp.patchstack.com/database/Wordpress/Plugin/wp-whydonate/vulnerability/wordpress-whydonate-plugin-4-0-15-broken-access-control-vulnerability · Note
• https://vdp.patchstack.com/database/Wordpress/Plugin/wp-whydonate/vulnerability/wordpress-whydonate-plugin-4-0-15-broken-access-control-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1990792039387328543 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/wp-whydonate/vulnerability/wordpress-whydonate-plugin-4-0-15-broken-access-control-vulnerability?_s_id=cve · Note