CVE-2025-12877
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the panding_blood_request_action() function in all versions up to, and including, 2.1.15. This makes it possible for unauthenticated attackers to delete arbitrary posts.
Risk Assessment
An unauthenticated attacker can delete arbitrary posts on the site, potentially leading to data loss or service disruption.
Recommendation
Update the IDonate plugin to a version later than 2.1.15 or remove it if not in use.
Other vulnerabilities in IDonate
See all- CVE-2025-67583Medium
The IDonate plugin (idonate) up to version 2.1.15 contains a missing authorization vulnerability. It allows exploiting incorrectly configured access control security levels.
- CVE-2025-4522Medium
The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Insecure Direct Object Reference via the admin_post_donor_delete() function in versions 2.0.0 to 2.1.9. Authenticated attackers with Subscriber-level access and above can delete arbitrary user accounts, including administrators, by supplying an arbitrary user_id parameter to wp_delete_user().
Original NVD description (English source)
The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized modification od data due to a missing capability check on the panding_blood_request_action() function in all versions up to, and including, 2.1.15. This makes it possible for unauthenticated attackers to delete arbitrary posts. CVE-2025-67583 is likely a duplicate of this.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS