CVE-2025-4522

MediumCVSS 6.5

Published: 07/11/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Insecure Direct Object Reference via the admin_post_donor_delete() function in versions 2.0.0 to 2.1.9. Authenticated attackers with Subscriber-level access and above can delete arbitrary user accounts, including administrators, by supplying an arbitrary user_id parameter to wp_delete_user().

Risk Assessment

Attackers can delete administrator accounts, leading to complete loss of control over the WordPress site and potential takeover.

Recommendation

Update the IDonate plugin to the latest patched version. Restrict access to high-privilege accounts and monitor user activity.

Other vulnerabilities in IDonate

CVE-2025-67583Medium
The IDonate plugin (idonate) up to version 2.1.15 contains a missing authorization vulnerability. It allows exploiting incorrectly configured access control security levels.

Original NVD description (English source)

The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Insecure Direct Object Reference via the admin_post_donor_delete() function in versions 2.0.0 to 2.1.9. By supplying an arbitrary user_id parameter value to the wp_delete_user() function, authenticated attackers, with Subscriber-level access and above could delete arbitrary user accounts, including those of administrators.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS