CVE-2025-64636
Deferred Deferred - Pending Action
Unauthenticated Broken Access Control in Donation Thermometer

Publication date: 2026-06-26

Last updated on: 2026-06-26

Assigner: Patchstack

Description
Unauthenticated Broken Access Control in Donation Thermometer <= 2.2.7 versions.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-26
Last Modified
2026-06-26
Generated
2026-06-26
AI Q&A
2026-06-26
EPSS Evaluated
N/A
NVD
CVE-2025-64636
EUVD
EUVD-2025-210354
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
patchstack donation_thermometer to 2.2.7 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

The vulnerability affects WordPress Donation Thermometer Plugin versions 2.2.7 and below, allowing unauthenticated users to perform privileged actions due to missing authorization checks.

Since no official patch is currently available, users are advised to update the plugin immediately if an update is released or seek assistance from their hosting provider or developer.

Additionally, Patchstack offers vulnerability mitigation solutions, including rapid protection and threat intelligence, which can be considered to reduce risk.

Executive Summary

The WordPress Donation Thermometer Plugin, versions 2.2.7 and below, contains a Broken Access Control vulnerability identified as CVE-2025-64636.

This vulnerability allows unauthenticated users to perform actions that normally require higher privileges because the plugin lacks proper authorization checks.

It is classified as a low severity and low priority issue with a CVSS score of 5.3 and falls under the OWASP Top 10 category A1: Broken Access Control.

Impact Analysis

This vulnerability can allow unauthenticated attackers to perform privileged actions within the Donation Thermometer plugin without proper authorization.

Although the risk of exploitation is considered low, it could lead to unauthorized modifications or misuse of the plugin's functionality.

Users are advised to update the plugin immediately or seek assistance from their hosting provider or developer to mitigate potential impacts.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-64636. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart