CVE-2025-49899 identifies a missing authorization vulnerability in the Whydonate WordPress plugin developed by jjlemstra, affecting all versions up to and including 4.0.15. The vulnerability arises because certain plugin functionalities are accessible without proper Access Control List (ACL) enforcement, allowing unauthenticated attackers to invoke these functions. The vulnerability is remotely exploitable over the network without requiring any privileges or user interaction, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The impact is limited to confidentiality, with no direct integrity or availability consequences reported. This means attackers may gain access to sensitive information or functionality that should be restricted, but cannot modify data or disrupt service. The vulnerability was reserved in June 2025 and published in October 2025, with no patches or known exploits currently available. Whydonate is a plugin used primarily by nonprofits and fundraising organizations to manage donations on WordPress sites. The missing authorization could allow attackers to bypass intended access restrictions, potentially exposing donor information or administrative functions. The lack of authentication requirement increases the risk of automated scanning and exploitation attempts once exploit code becomes available. However, the absence of known exploits and the medium severity rating suggest the threat is moderate at this time. Organizations using Whydonate should monitor for updates and prepare to apply patches promptly.

For European organizations, particularly nonprofits and charities relying on the Whydonate plugin for donation management, this vulnerability could lead to unauthorized disclosure of donor information or access to administrative functions. While the impact is limited to confidentiality and does not affect data integrity or availability, exposure of sensitive donor data could damage organizational reputation and violate data protection regulations such as GDPR. The ease of exploitation (no authentication or user interaction required) increases the risk of automated attacks, especially on publicly accessible WordPress sites. However, the lack of known exploits in the wild and the medium severity rating reduce the immediate threat level. Organizations with high volumes of donor data or those subject to strict compliance requirements should prioritize remediation. Failure to address this vulnerability could result in data breaches, regulatory fines, and loss of donor trust.

1. Immediately audit all WordPress sites using the Whydonate plugin to identify affected versions (<= 4.0.15). 2. Restrict access to the plugin’s administrative and sensitive functions via web application firewalls (WAF) or server-level access controls to limit exposure until patches are available. 3. Monitor web server and application logs for unusual or unauthorized access attempts targeting Whydonate endpoints. 4. Engage with the plugin vendor or community to obtain patches or updates addressing the missing authorization issue as soon as they are released. 5. Implement strict role-based access controls within WordPress to minimize privileges granted to users interacting with the plugin. 6. Consider temporarily disabling the plugin if it is not critical to operations until a secure version is deployed. 7. Ensure comprehensive backup and incident response plans are in place to quickly respond to any exploitation attempts. 8. Educate site administrators about the risks and signs of exploitation related to this vulnerability.