CVE-2025-4522
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Insecure Direct Object Reference via the admin_post_donor_delete() function in versions 2.0.0 to 2.1.9. Authenticated attackers with Subscriber-level access and above can delete arbitrary user accounts, including administrators, by supplying an arbitrary user_id parameter to wp_delete_user().
Risk Assessment
Attackers can delete administrator accounts, leading to complete loss of control over the WordPress site and potential takeover.
Recommendation
Update the IDonate plugin to the latest patched version. Restrict access to high-privilege accounts and monitor user activity.
Other vulnerabilities in IDonate
See all- CVE-2025-67583Medium
The IDonate plugin (idonate) up to version 2.1.15 contains a missing authorization vulnerability. It allows exploiting incorrectly configured access control security levels.
- CVE-2025-12877Medium
The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the panding_blood_request_action() function in all versions up to, and including, 2.1.15. This makes it possible for unauthenticated attackers to delete arbitrary posts.
Original NVD description (English source)
The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Insecure Direct Object Reference via the admin_post_donor_delete() function in versions 2.0.0 to 2.1.9. By supplying an arbitrary user_id parameter value to the wp_delete_user() function, authenticated attackers, with Subscriber-level access and above could delete arbitrary user accounts, including those of administrators.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS