In today’s digital world, safeguarding sensitive data is paramount, especially for platforms handling personal information. A recent discovery, identified as CVE-2025-4523, highlights a significant data exposure vulnerability within the popular IDonate – Blood Donation, Request And Donor Management System plugin for WordPress. This flaw could allow unauthorized individuals to access private data, underscoring the importance of timely security updates.
CVE Details
This vulnerability affects the IDonate – Blood Donation, Request And Donor Management System plugin for WordPress. It was published on August 1, 2025, and has a CVSS Score of 6.5, categorizing it as Medium severity. The vulnerability’s status is currently “Analyzed,” meaning it has been investigated and understood.
Affected Products
The core issue lies within the IDonate plugin for WordPress, specifically impacting versions 2.0.0 through 2.1.9. The vulnerability stems from a missing capability check on the admin_donor_profile_view() function. This oversight allows individuals with lower-level access, such as authenticated subscribers, to view information typically reserved for administrators.
Affected versions include:
- IDonate – Blood Donation, Request And Donor Management System plugin for WordPress versions 2.0.0 to 2.1.9
Current Status
The vulnerability, CVE-2025-4523, has been fully analyzed. Developers of the IDonate plugin have addressed this security flaw. A patch was released in version 2.2.0, effectively closing the loophole that led to unauthorized data access. Users running any affected version should prioritize updating their plugin to the latest secure release.
Severity Level
Rated as Medium severity with a CVSS Score of 6.5, this vulnerability could lead to significant data exposure. While it doesn’t allow for complete system takeover, it enables authenticated attackers with Subscriber-level access (or higher) to view an administrator’s username, email address, and all fields related to donors. This means sensitive personal information could be compromised, leading to privacy breaches and potential misuse of data.
Possible Solutions
The most crucial step to mitigate this vulnerability is to immediately update your IDonate – Blood Donation, Request And Donor Management System plugin to version 2.2.0 or a later, patched version. This update includes the necessary security fixes to prevent unauthorized access to sensitive donor and administrator information.
Beyond this specific patch, it’s always a good practice to:
- Keep all your WordPress plugins, themes, and core installation updated to their latest versions.
- Implement strong, unique passwords for all user accounts, especially administrative ones.
- Regularly conduct security audits and scans on your WordPress website.
- Follow WordPress security best practices to protect your site and its data.
References
https://plugins.trac.wordpress.org/browser/idonate/tags/2.1.9/src/Admin/Admin.php#L76
https://plugins.trac.wordpress.org/browser/idonate/tags/2.1.9/src/Helpers/IDonateAjaxHandler.php#L48
https://plugins.trac.wordpress.org/changeset/3334424/
IDonate – Blood Donation, Request And Donor Management System
https://www.wordfence.com/threat-intel/vulnerabilities/id/5fe7668b-9d70-44b7-a347-3922c0b8684c?source=cve
