CVE-2025-30639: 
WordPress vulnerability analysis and mitigation

CVE-2025-30639 is a Missing Authorization (Broken Access Control) vulnerability in the ThemeAtelier IDonatePro WordPress plugin. It allows unauthenticated remote attackers to exploit incorrectly configured access control security levels, affecting all versions of IDonatePro from n/a through 2.1.9. The vulnerability was published on August 14, 2025, and assigned by Patchstack. It carries a CVSS v3.1 base score of 7.5 (High) (Feedly/EUVD, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing sensitive operations. The attack vector is network-based with no authentication required (AV:N/AC:L/PR:N/UI:N), indicating that the vulnerable functionality is accessible without any login or user interaction. This type of flaw typically arises when WordPress REST API endpoints, AJAX handlers, or admin actions lack proper capability checks (e.g., current_user_can()), allowing arbitrary users to invoke privileged functionality (Feedly/EUVD, Patchstack).

Successful exploitation results in a high integrity impact with no confidentiality or availability impact (C:N/I:H/A:N), meaning an attacker can make unauthorized modifications to data or plugin functionality without being able to read sensitive data or cause a denial of service. In the context of a donation plugin, this could allow unauthenticated attackers to manipulate donation records, alter payment configurations, or modify campaign settings. The scope is limited to the affected WordPress installation, but integrity compromise of a donation platform could have significant financial and reputational consequences for site operators (Feedly/EUVD).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-30639 as of the available data. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly, Patchstack).

Users of the IDonatePro WordPress plugin should update to a version beyond 2.1.9 if a patched release is available from ThemeAtelier. If no patch is yet available, site administrators should consider deactivating the plugin until a fix is released, or restricting access to the WordPress site's AJAX and REST API endpoints via firewall rules or a Web Application Firewall (WAF). Monitoring WordPress admin logs for unexpected changes to donation campaigns or payment settings is also recommended as a compensating control (Patchstack).

The vulnerability was reported in the Wordfence Intelligence Weekly WordPress Vulnerability Report for August 4–10, 2025, indicating it received standard coverage in the WordPress security community (Wordfence). No notable researcher commentary or broader media coverage has been identified beyond routine vulnerability database listings.