CVE-2025-22715: 
WordPress vulnerability analysis and mitigation

CVE-2025-22715 is a Missing Authorization vulnerability in the WordPress plugin "WP Attractive Donations System - Easy Stripe & Paypal donations" (by loopus), classified as an Arbitrary Content Deletion flaw. It affects all plugin versions up to and including 1.25. The vulnerability was reported by João Pedro S Alcântara (Kinorth) on August 21, 2025, and publicly disclosed by Patchstack on January 8, 2026. The CVSS v3.1 base score is 7.5 (High), assigned by Patchstack (Patchstack).

The root cause is CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing sensitive operations (OWASP A1: Broken Access Control). This allows an unauthenticated attacker to invoke plugin functionality that should be restricted, resulting in arbitrary deletion of WordPress content such as posts, pages, or media. No authentication or user interaction is required, and the attack is conducted entirely over the network (Patchstack).

Successful exploitation allows an unauthenticated remote attacker to delete arbitrary content from the affected WordPress site, including posts, pages, and images. This results in a high availability impact — site content can be permanently destroyed — while confidentiality and integrity of remaining data are not directly affected per the Patchstack CVSS assessment. The impact is limited to the WordPress installation scope, but mass-exploit campaigns targeting thousands of sites simultaneously are considered likely given the unauthenticated attack vector (Patchstack).

No public proof-of-concept exploit code has been observed, and there is no evidence of active in-the-wild exploitation at this time. The vulnerability requires no authentication and no user interaction, making it trivially exploitable if targeted. Patchstack rates it as high priority and notes that vulnerabilities of this class are frequently used in mass-exploit campaigns against WordPress sites. The EPSS score is approximately 0.017% (0.000170), indicating a currently low but non-negligible probability of exploitation. The vulnerability is not listed in the CISA KEV catalog (Patchstack).

As of the disclosure date, no official patch from the plugin developer (loopus) is available for versions up to and including 1.25. Site administrators should consider deactivating and removing the plugin until a patched version is released. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts in the interim. Additionally, implementing a web application firewall (WAF) and restricting access to WordPress admin endpoints can reduce exposure (Patchstack).