CVE-2021-24572: Paypal Donation < 1.3.1 - CSRF to Arbitrary Post Deletion

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-11-01 · updated 2026-06-17
Weakness: CWE-352

Description

The Accept Donations with PayPal WordPress plugin before 1.3.1 provides a function to create donation buttons which are internally stored as posts. The deletion of a button is not CSRF protected and there is no control to check if the deleted post was a button post. As a result, an attacker could make logged in admins delete arbitrary posts

Affected products

Accept Donations with PayPal: before 1.3.1 — fixed in 1.3.1

How to fix

Upgrade to a fixed version: Accept Donations with PayPal 1.3.1. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/7b1ebd26-ea8b-448c-a775-66a04102e44f
https://wpscan.com/vulnerability/7b1ebd26-ea8b-448c-a775-66a04102e44f

Get alerted when CVE-2021-24572 or the next vulnerability affects your stack