Understanding the IDonate Plugin Security Flaw
The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress has a security flaw that could allow unauthorized users to delete accounts. This vulnerability, tracked as CVE-2025-4522, is an Insecure Direct Object Reference (IDOR) issue that affects versions 2.0.0 through 2.1.9 of the plugin. Simply put, if you’re using an affected version, a malicious user with even basic subscriber access could potentially remove any user account on your WordPress site, including those belonging to administrators.
An Insecure Direct Object Reference (IDOR) vulnerability occurs when a web application exposes a direct reference to an internal implementation object, like a database key, file, or directory. Attackers can then manipulate these references to access or modify resources they shouldn’t have permission to. In this case, by changing a user ID number in a request, a low-privileged user could instruct the system to delete a user account that isn’t their own.
CVE Details
Product Name: IDonate – Blood Donation, Request And Donor Management System plugin for WordPress
Published: November 7, 2025
Severity: Medium
Status: Analyzed
Affected Products
The IDOR vulnerability impacts the IDonate – Blood Donation, Request And Donor Management System plugin for WordPress. Specifically, all versions from 2.0.0 up to and including 2.1.9 are vulnerable. If your website uses this plugin within this version range, it is crucial to take action.
Current Status
This vulnerability has been analyzed and confirmed. Fortunately, a fix has been released by the plugin developers. The issue was addressed in version 2.1.10 of the IDonate plugin, which prevents unauthorized users from exploiting this IDOR vulnerability to delete arbitrary user accounts.
Severity Level
The severity of CVE-2025-4522 is rated as Medium, with a CVSS score of 6.5. While an attacker needs to be authenticated to your WordPress site (meaning they need at least a Subscriber-level account), the potential impact is significant. An attacker could delete critical user accounts, including those of administrators, which could disrupt your website’s operations, compromise user data integrity, and lead to a denial of service for affected users.
Possible Solutions
The most important step to protect your WordPress site from this vulnerability is to update your IDonate – Blood Donation, Request And Donor Management System plugin immediately. Ensure you update to version 2.1.10 or higher. This version contains the necessary patch to close the IDOR loophole.
Always keep your WordPress core, themes, and plugins updated to their latest versions to ensure you have the most recent security fixes. Additionally, follow the principle of least privilege, granting users only the minimum access levels required for their roles.
References
https://plugins.trac.wordpress.org/browser/idonate/tags/2.1.9/src/Admin/Admin.php#L75
https://plugins.trac.wordpress.org/browser/idonate/tags/2.1.9/src/Helpers/DonorFunctions.php#L658
https://plugins.trac.wordpress.org/changeset/3334424/idonate/tags/2.1.10/src/Helpers/DonorFunctions.php?old=3279142&old_path=idonate%2Ftags%2F2.1.9%2Fsrc%2FHelpers%2FDonorFunctions.php
IDonate – Blood Donation, Request And Donor Management System
https://www.wordfence.com/threat-intel/vulnerabilities/id/bb0625ec-5ac9-4896-ac11-87fc9287f68a?source=cve
