Accept Donations with PayPal < 1.3.4 - Arbitrary Post Deletion via CSRF
Priority LOW 30CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.
Summary
The Accept Donations with PayPal WordPress plugin before 1.3.4 does not have CSRF check in place and does not ensure that the post to be deleted belongs to the plugin, allowing attackers to make a logged in admin delete arbitrary posts from the blog
Why it matters now
EPSS 0.00538 45th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Accept Donations with PayPal (Unknown): 1.3.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Accept Donations with PayPal | 1.3.4 to before 1.3.4 | 1.3.4 | Patch available | CNA |
- Accept Donations with PayPal VendorUnknown Affected 1.3.4 to before 1.3.4 Fixed in 1.3.4 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wpplugin:accept_donations_with_paypal:*:*:*:*:*:wordpress:*:* | before 1.3.4 | Vulnerable | Scott Paterson |
- cpe:2.3:a:wpplugin:accept_donations_with_paypal:*:*:*:*:*:wordpress:*:* Versions before 1.3.4 Vulnerable ·Scott Paterson
Remediation
- Fix · CNA Accept Donations with PayPal (Unknown) Fixed in 1.3.4
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24989
- 2026-10-03 Alias added: GHSA-vpr8-rx78-hh89
References
More Scott Paterson Accept Donations With Paypal vulnerabilities
- TI-2025-30014 WordPress Accept Donations with PayPal plugin <= 1.4.5 - CSRF to Stored XSS vulnerability CVSS 3.1HIGH 7.1
- TI-2021-07097 Paypal Donation < 1.3.2 - Admin+ Stored Cross-Site Scripting CVSS 3.1MEDIUM 4.8
- TI-2021-06855 Paypal Donation < 1.3.1 - CSRF to Stored Cross-Site Scripting CVSS 3.1MEDIUM 4.3
- TI-2021-06857 Paypal Donation < 1.3.1 - CSRF to Arbitrary Post Deletion CVSS 3.1MEDIUM 4.3
Sources
- CVE-2021-24989 · CVE Program
- CVE-2021-24989 · NVD
- FIRST EPSS
- GHSA-vpr8-rx78-hh89 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences