A critical missing authorization flaw in the WP Attractive Donations System plugin exposes unauthenticated users to potential service disruption or unauthorized access.

The vulnerability is categorized as CWE-862: Missing Authorization. It exists because the plugin fails to perform proper capability checks on sensitive functions, allowing an unauthenticated attacker to interact with the system in unintended ways.

The vulnerability carries a CVSS score of 8.1, indicating a high level of risk to organizational assets. An attacker may exploit this flaw to disrupt service availability or manipulate donation system configurations, potentially leading to financial discrepancies and loss of user trust. Given the ease of exploitation, this represents a significant threat to the integrity of the WordPress environment.

Immediate Action: Since no specific patch version is currently identified, administrators should immediately deactivate and remove the WP Attractive Donations System plugin until a secure update is provided by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests directed at plugin-specific endpoints or repeated unauthorized attempts to access administrative functions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious traffic patterns and restrict access to the WordPress plugin directory endpoints.

Public Exploit Available: Unknown.

Due to the lack of a verified patch and the high severity of this unauthenticated access flaw, immediate deactivation of the affected plugin is the only effective way to eliminate the risk. Security teams should monitor the vendor's official support channels for release notes regarding a security update before considering re-enabling the plugin.