Unauthenticated Broken Access Control in Donation Thermometer

Executive Summary

The WordPress Donation Thermometer Plugin, versions 2.2.7 and below, contains a Broken Access Control vulnerability identified as CVE-2025-64636.

This vulnerability allows unauthenticated users to perform actions that normally require higher privileges because the plugin lacks proper authorization checks.

It is classified as a low severity and low priority issue with a CVSS score of 5.3 and falls under the OWASP Top 10 category A1: Broken Access Control.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow unauthenticated attackers to perform privileged actions within the Donation Thermometer plugin without proper authorization.

Although the risk of exploitation is considered low, it could lead to unauthorized modifications or misuse of the plugin's functionality.

Users are advised to update the plugin immediately or seek assistance from their hosting provider or developer to mitigate potential impacts.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability affects WordPress Donation Thermometer Plugin versions 2.2.7 and below, allowing unauthenticated users to perform privileged actions due to missing authorization checks.

Since no official patch is currently available, users are advised to update the plugin immediately if an update is released or seek assistance from their hosting provider or developer.

Additionally, Patchstack offers vulnerability mitigation solutions, including rapid protection and threat intelligence, which can be considered to reduce risk.

Useful 0 Not Useful 0