CVE-2025-60045: 
WordPress vulnerability analysis and mitigation

CVE-2025-60045 is a Missing Authorization (Broken Access Control) vulnerability in the ThemeAtelier IDonatePro WordPress plugin that allows unauthenticated attackers to access functionality not properly constrained by ACLs. It affects IDonatePro versions up to and including 2.1.11, with no official patch available as of the time of disclosure. The vulnerability was reported by João Pedro S Alcântara (Kinorth) on July 23, 2025, and published by Patchstack on August 22, 2025. It carries a CVSS v3.1 base score of 7.5 (High) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization, authentication, or nonce token checks on one or more functions. This allows unauthenticated network-based attackers to invoke privileged functionality that should be restricted to higher-privileged users. The attack requires no user interaction, no special privileges, and low complexity, making it trivially exploitable over the network (Patchstack).

Successful exploitation allows unauthenticated attackers to access or invoke restricted plugin functionality, resulting in a high confidentiality impact with no integrity or availability impact per the CVSS scoring. In practice, this could expose sensitive donation data, donor information, or administrative plugin features to unauthorized parties. Patchstack classifies this as highly dangerous and notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or traffic (Patchstack).

No official patch is currently available, and Patchstack has flagged this vulnerability as expected to be exploited, noting its suitability for mass-exploit campaigns. The required privilege level is unauthenticated, and the attack vector is network-accessible with low complexity, making it highly accessible to opportunistic attackers. The EPSS score is approximately 0.017% (0.000170), indicating a currently low but non-zero probability of exploitation in the near term. There is no confirmed evidence of active in-the-wild exploitation or CISA KEV catalog listing at this time (Patchstack).

1. Reconnaissance: Identify WordPress sites running the IDonatePro plugin (version ≤ 2.1.11) using tools like WPScan, Shodan, or by checking publicly accessible readme.txt or plugin metadata files.
2. Identify unprotected endpoints: Enumerate the plugin's registered WordPress AJAX actions or REST API endpoints that lack proper capability checks or nonce validation.
3. Craft unauthenticated request: Send a direct HTTP POST or GET request to the vulnerable endpoint (e.g., wp-admin/admin-ajax.php with the relevant action parameter) without any authentication cookies or nonce tokens.
4. Access restricted functionality: The server processes the request without authorization checks, returning sensitive data or performing privileged actions (e.g., accessing donor records or administrative plugin settings).
5. Exfiltrate data: Collect any returned sensitive information such as donor names, email addresses, payment references, or configuration data for further use or sale (Patchstack).

• Network: Unusual unauthenticated POST or GET requests to wp-admin/admin-ajax.php or plugin-specific REST endpoints with IDonatePro-related action parameters from unknown or automated IP addresses.
• Logs: WordPress access logs showing repeated requests to plugin AJAX handlers without session cookies or authentication headers, particularly from scanning IP ranges.
• Logs: High-frequency requests to IDonatePro plugin endpoints in a short time window, indicative of automated mass-scanning activity.
• File System: No file-system artifacts expected for this access control bypass, but review for any unexpected data exports or log entries generated by the plugin's administrative functions.

As of the disclosure date, no official patch from ThemeAtelier is available for IDonatePro. Site administrators are advised to deactivate and remove the IDonatePro plugin until a patched version is released. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts in the interim. Users should monitor the plugin's official WordPress repository for an updated version and apply it immediately upon release (Patchstack).

Patchstack, which discovered and disclosed the vulnerability through researcher João Pedro S Alcântara (Kinorth), has classified it as high priority and warned of its potential for use in mass-exploit campaigns targeting WordPress sites. No additional notable vendor statements, researcher commentary, or significant media coverage beyond the Patchstack advisory have been identified at this time (Patchstack).