The vulnerability identified as CVE-2025-60045 affects ThemeAtelier's IDonatePro plugin (version ≤ 2.1.11). It is a Missing Authorization issue where certain functionality is accessible without proper ACL enforcement, potentially allowing unauthenticated attackers to invoke privileged functions. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact without integrity or availability impact. There is no vendor advisory or patch information provided, and the product is not a cloud service.

An attacker can access sensitive functionality without authorization, potentially leading to unauthorized disclosure of confidential information. The vulnerability does not impact integrity or availability. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor ThemeAtelier's communications for updates. Until a patch is available, consider restricting access to the affected plugin functionality through other means such as web application firewalls or access controls at the network or application level.