CVE-2025-10186 is a missing authorization vulnerability in the WhyDonate – FREE Donate button – Crowdfunding – Fundraising WordPress plugin by jjlemstra. The vulnerability arises because the remove_row function does not perform capability checks, enabling unauthenticated attackers to delete rows from the wp_wdplugin_style table. This can lead to unauthorized data loss. The issue affects all versions up to and including 4.0.15. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but integrity impact is low.

An attacker without authentication can delete data rows from the plugin's wp_wdplugin_style table, resulting in unauthorized data loss. There is no reported impact on confidentiality or availability. The integrity of the plugin's stored style data is compromised, which may affect plugin functionality or appearance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the WordPress installation and monitor for suspicious activity related to the WhyDonate plugin. Avoid using affected versions and consider disabling the plugin if possible.