The vulnerability identified as CVE-2025-49899 affects the Whydonate WordPress plugin by jjlemstra. It is characterized by missing authorization controls, allowing unauthenticated users to access certain plugin functionalities that should be restricted by ACLs. The affected versions include all releases up to 4.0.15. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) indicates network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no impact on confidentiality or integrity, but a low impact on availability. No patch or mitigation details are currently provided by the vendor or other authoritative sources.

The vulnerability allows unauthorized access to functionality within the Whydonate plugin, potentially leading to availability disruptions. There is no impact on data confidentiality or integrity. No known active exploitation has been reported. The medium CVSS score reflects the potential for denial of service or similar availability issues due to missing authorization checks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin's functionalities through other means such as web application firewalls or limiting access to trusted users only. Monitor official jjlemstra Whydonate plugin channels for updates and apply patches promptly once available.