The vulnerability CVE-2025-58938 in ThemeAtelier IDonatePro (up to version 2.1.9) arises from missing authorization controls, enabling attackers without privileges to perform unauthorized actions. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low attack complexity, no privileges required, no user interaction, and an impact limited to integrity. There is no vendor advisory or patch link available, and the product is not a cloud service, so remediation status is unknown.

Exploitation of this vulnerability can lead to unauthorized modification or manipulation of data or functionality within the IDonatePro plugin, affecting the integrity of the affected system. There is no reported impact on confidentiality or availability. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin features and monitor for unusual activity related to access control misuse. Avoid deploying the vulnerable versions in sensitive environments if possible.