CVE-2023-38475 is a medium severity (CVSS 4.3) missing authorization flaw in the Donations Made Easy Smart Donations WordPress plugin, through version 4.0.12. Patchstack lists no patched version, so check the plugin page for a newer release, restrict subscriber accounts, or replace the plugin.
What's affected
The affected product is Donations Made Easy, also called Smart Donations, from RedNao, a WordPress plugin, in all versions through 4.0.12. The weakness is missing authorization, described as exploiting incorrectly configured access control security levels. The record is dated 2024-12-13 and scores 4.3, Medium, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N: a low privilege account can make a low impact change to integrity.
Patchstack's entry lists the vulnerable versions as 4.0.12 and below and the required privilege as Subscriber. It lists no patched version, and its fix section was not populated when I read it. That is a signal that the plugin may not have received a fix, or that the entry has not been updated. I cannot confirm either from the sources. Check the plugin's page in the WordPress directory for the latest version and changelog before deciding.
Weakness class: CWE-862.
How to check if you're exposed
Read the installed version with WP-CLI.
wp plugin list --name=smart-donations --fields=name,version,status,update
Or open the Plugins screen. Any version at or below 4.0.12 is in the affected range. Then check whether the plugin shows an update. If no update is offered, look at when the plugin was last updated in the WordPress directory, since an abandoned plugin keeps its flaws.
What to do now
- Find every site that has Smart Donations installed and record its version.
- Check the WordPress plugin directory and the developer's site for a release newer than 4.0.12.
- If a fixed release exists, update. If none does, consider moving to a maintained donations plugin.
- Turn off open registration, or reduce what Subscriber accounts can reach, so low privilege access is harder to get.
- Review donation settings and records for changes you did not make.
Why it matters
The impact here is limited. A logged-in user with the lowest role can change something they should not, and the vector shows no loss of confidentiality or availability. That explains the Medium score.
The more useful lesson is about maintenance. A plugin with no patch listed for a known flaw is a risk of its own, because every later issue is also likely to stay open. Donation plugins also sit next to payment flows, so even small integrity changes deserve care. The CVE is not on the CISA Known Exploited Vulnerabilities list, and Patchstack does not describe exploitation.
Missing authorization means the code performs an action for a logged-in user without checking that this user is allowed to do it. In WordPress plugins this often shows up as an AJAX or REST handler that checks the request is authenticated, or a nonce is valid, but never checks the user's capability. Low-privilege accounts such as subscribers and contributors can then reach functions meant for administrators.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the dependencies a code project declares. Plugins installed on a live WordPress site are better tracked with WP-CLI or your hosting dashboard, so use both.
Quick check
Is there a fixed version?
Patchstack lists none for this entry. Check the plugin directory and the developer for a newer release.
How serious is it?
Medium. A low privilege user can make a low impact change to integrity, and nothing in the vector suggests data loss or downtime.
Sources
Last reviewed: 19 October 2026.
