CVE-2025-67583

MediumCVSS 5.3

Published: 09/12/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

10th percentile - higher than 10% of all known CVEs

Summary

The IDonate plugin (idonate) up to version 2.1.15 contains a missing authorization vulnerability. It allows exploiting incorrectly configured access control security levels.

Risk Assessment

Unauthorized persons may gain access to functions or data they should not have access to, potentially leading to a breach of data confidentiality or integrity.

Recommendation

Update the IDonate plugin to the latest available version that includes a fix for this vulnerability.

Other vulnerabilities in IDonate

CVE-2025-4522Medium
The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Insecure Direct Object Reference via the admin_post_donor_delete() function in versions 2.0.0 to 2.1.9. Authenticated attackers with Subscriber-level access and above can delete arbitrary user accounts, including administrators, by supplying an arbitrary user_id parameter to wp_delete_user().

Original NVD description (English source)

Missing Authorization vulnerability in Foysal Imran IDonate idonate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IDonate: from n/a through <= 2.1.15.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS