TI-2021-06857 Aliases CVE-2021-24572 GHSA-887j-hc67-xww2

Paypal Donation < 1.3.1 - CSRF to Arbitrary Post Deletion

LOW 20CWE-352Published 2021-11-01 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Tampering
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

The Accept Donations with PayPal WordPress plugin before 1.3.1 provides a function to create donation buttons which are internally stored as posts. The deletion of a button is not CSRF protected and there is no control to check if the deleted post was a button post. As a result, an attacker could make logged in admins delete arbitrary posts

Why it matters now

EPSS 0.00468 40th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Accept Donations with PayPal (Unknown): 1.3.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Accept Donations with PayPal	1.3.1 to before 1.3.1	1.3.1	Patch available	CNA

Accept Donations with PayPal VendorUnknown Affected 1.3.1 to before 1.3.1 Fixed in 1.3.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:wpplugin:accept_donations_with_paypal::::::wordpress::*	before 1.3.1	Vulnerable	Scott Paterson

cpe:2.3:a:wpplugin:accept_donations_with_paypal:*:*:*:*:*:wordpress:*:* Versions before 1.3.1 Vulnerable ·Scott Paterson

Remediation

Fix · CNA Accept Donations with PayPal (Unknown) Fixed in 1.3.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2021-11-01
Accept Donations with PayPal 1.3.1
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2021-06855 Paypal Donation < 1.3.1 - CSRF to Stored Cross-Site ScriptingPriority LOW 21
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2021-24572
2026-10-03 Alias added: GHSA-887j-hc67-xww2

References

Exploit 1

https://wpscan.com/vulnerability/7b1ebd26-ea8b-448c-a775-66a04102e44f

TI-2025-30014 WordPress Accept Donations with PayPal plugin <= 1.4.5 - CSRF to Stored XSS vulnerability CVSS 3.1HIGH 7.1
TI-2021-07268 Accept Donations with PayPal < 1.3.4 - Arbitrary Post Deletion via CSRF CVSS 3.1MEDIUM 6.5
TI-2021-07097 Paypal Donation < 1.3.2 - Admin+ Stored Cross-Site Scripting CVSS 3.1MEDIUM 4.8
TI-2021-06855 Paypal Donation < 1.3.1 - CSRF to Stored Cross-Site Scripting CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences