This vulnerability in AidWP's wp-stripe-donation feature arises from missing authorization checks, permitting attackers to bypass access control restrictions. The issue affects all versions up to and including 3.2.3. The CVSS vector indicates the attack can be performed remotely without authentication or user interaction, but the impact is limited to low confidentiality impact with no integrity or availability effects. No official patch or vendor advisory is currently provided, and no exploits are known in the wild.

An attacker can exploit the missing authorization to gain unauthorized access to certain functionality or data within the AidWP plugin, potentially exposing some confidential information. However, the vulnerability does not affect data integrity or availability. The overall impact is limited to confidentiality with no known active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from the vendor or plugin maintainers. Applying principle of least privilege and restricting access to the affected plugin features may reduce risk temporarily.