CVE-2025-10186 Overview
CVE-2025-10186 affects the WhyDonate WordPress plugin, a free donate button and crowdfunding tool. The vulnerability stems from a missing capability check on the remove_row function in all versions up to and including 4.0.15. Unauthenticated attackers can send requests that delete rows from the wp_wdplugin_style table. The flaw is classified as Missing Authorization [CWE-862] and requires no user interaction or privileges to exploit. Impacted sites face integrity loss when plugin style configurations are removed by remote actors.
Critical Impact
Unauthenticated attackers can remotely delete records from the plugin's style table, causing unauthorized data loss on affected WordPress sites.
Affected Products
- WhyDonate – FREE Donate button – Crowdfunding – Fundraising plugin for WordPress
- All versions up to and including 4.0.15
- WordPress sites with the vulnerable plugin installed and active
Discovery Timeline
- 2025-10-15 - CVE-2025-10186 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10186
Vulnerability Analysis
The WhyDonate plugin exposes a remove_row function that deletes entries from the wp_wdplugin_style table. The function lacks a capability check and does not verify whether the caller has permission to perform the destructive action. Because WordPress routes AJAX and admin-post endpoints through publicly reachable handlers, the missing authorization allows unauthenticated network requests to trigger row deletion. The scope of impact is limited to integrity — attackers cannot read data or take down the site directly, but they can degrade plugin functionality by removing stored style rows.
Root Cause
The root cause is a Missing Authorization weakness [CWE-862]. The remove_row handler omits both a current_user_can() capability verification and a nonce check. Without these controls, WordPress cannot distinguish between legitimate administrator requests and anonymous external requests, so any HTTP client can invoke the deletion path.
Attack Vector
An attacker sends a crafted HTTP request to the plugin's exposed endpoint that maps to remove_row. No authentication, session, or user interaction is needed. The request supplies the row identifier to remove, and the plugin executes the delete against wp_wdplugin_style. Repeated requests can empty the table and disrupt the plugin's configured styles. Refer to the Wordfence Vulnerability Analysis and the WordPress Plugin Changeset for the patched code path.
Detection Methods for CVE-2025-10186
Indicators of Compromise
- Unexpected reduction or missing rows in the wp_wdplugin_style database table.
- Loss of custom styling or configuration in the WhyDonate donate button on public pages.
- Access log entries showing unauthenticated POST requests to WhyDonate plugin AJAX or admin-post endpoints.
Detection Strategies
- Review WordPress access logs for requests targeting admin-ajax.php or plugin endpoints with the remove_row action from unauthenticated sources.
- Compare current contents of wp_wdplugin_style against known-good backups to identify unauthorized deletions.
- Enable WordPress audit logging plugins to record row-level changes to plugin tables.
Monitoring Recommendations
- Alert on anomalous request volume to WhyDonate plugin endpoints, especially from a single source IP.
- Monitor database delete operations against plugin-owned tables and correlate them with authenticated administrator sessions.
- Track the installed version of the WhyDonate plugin across managed WordPress sites and flag any instance at 4.0.15 or below.
How to Mitigate CVE-2025-10186
Immediate Actions Required
- Update the WhyDonate plugin to a version later than 4.0.15 on every affected WordPress site.
- Back up the wp_wdplugin_style table before applying updates so deletions can be reversed if needed.
- Restrict access to admin-ajax.php endpoints associated with the plugin using a web application firewall until the update is applied.
Patch Information
The vendor addressed the issue by adding an authorization check to the remove_row handler. Details of the code change are available in the WordPress Plugin Changeset and on the WordPress WP-WhyDonate Plugin page. Site owners should install the latest available release through the WordPress plugin manager.
Workarounds
- Deactivate the WhyDonate plugin until a patched version is installed if immediate upgrade is not possible.
- Deploy a WAF rule that blocks unauthenticated requests carrying the remove_row action parameter to the plugin.
- Restrict administrative endpoints through IP allowlisting on the web server or reverse proxy.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
