IDonate vulnerabilities

The IDonate plugin (idonate) up to version 2.1.15 contains a missing authorization vulnerability. It allows exploiting incorrectly configured access control security levels.

The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the panding_blood_request_action() function in all versions up to, and including, 2.1.15. This makes it possible for unauthenticated attackers to delete arbitrary posts.

The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Insecure Direct Object Reference via the admin_post_donor_delete() function in versions 2.0.0 to 2.1.9. Authenticated attackers with Subscriber-level access and above can delete arbitrary user accounts, including administrators, by supplying an arbitrary user_id parameter to wp_delete_user().