The IDonate \u2013 Blood Donation, Request And Donor Management System plugin for WordPress has a security flaw that could allow unauthorized users to delete accounts. This vulnerability, tracked as CVE-2025-4522, is an Insecure Direct Object Reference (IDOR) issue that affects versions 2.0.0 through 2.1.9 of the plugin. Simply put, if you’re using an affected version, a malicious user with even basic subscriber access could potentially remove any user account on your WordPress site, including those belonging to administrators.<\/p>\n
An Insecure Direct Object Reference (IDOR) vulnerability occurs when a web application exposes a direct reference to an internal implementation object, like a database key, file, or directory. Attackers can then manipulate these references to access or modify resources they shouldn’t have permission to. In this case, by changing a user ID number in a request, a low-privileged user could instruct the system to delete a user account that isn’t their own.<\/p>\n
Product Name:<\/strong> IDonate \u2013 Blood Donation, Request And Donor Management System plugin for WordPress<\/p>\n Published:<\/strong> November 7, 2025<\/p>\n Severity:<\/strong> Medium<\/p>\n Status:<\/strong> Analyzed<\/p>\n The IDOR vulnerability impacts the IDonate \u2013 Blood Donation, Request And Donor Management System plugin for WordPress. Specifically, all versions from 2.0.0 up to and including 2.1.9<\/strong> are vulnerable. If your website uses this plugin within this version range, it is crucial to take action.<\/p>\n This vulnerability has been analyzed and confirmed. Fortunately, a fix has been released by the plugin developers. The issue was addressed in version 2.1.10 of the IDonate plugin, which prevents unauthorized users from exploiting this IDOR vulnerability to delete arbitrary user accounts.<\/p>\n The severity of CVE-2025-4522 is rated as Medium<\/strong>, with a CVSS score of 6.5. While an attacker needs to be authenticated to your WordPress site (meaning they need at least a Subscriber-level account), the potential impact is significant. An attacker could delete critical user accounts, including those of administrators, which could disrupt your website’s operations, compromise user data integrity, and lead to a denial of service for affected users.<\/p>\n The most important step to protect your WordPress site from this vulnerability is to update your IDonate \u2013 Blood Donation, Request And Donor Management System plugin immediately. Ensure you update to version 2.1.10 or higher<\/strong>. This version contains the necessary patch to close the IDOR loophole.<\/p>\n Always keep your WordPress core, themes, and plugins updated to their latest versions to ensure you have the most recent security fixes. Additionally, follow the principle of least privilege, granting users only the minimum access levels required for their roles.<\/p>\n https:\/\/plugins.trac.wordpress.org\/browser\/idonate\/tags\/2.1.9\/src\/Admin\/Admin.php#L75<\/p>\n https:\/\/plugins.trac.wordpress.org\/browser\/idonate\/tags\/2.1.9\/src\/Helpers\/DonorFunctions.php#L658<\/p>\n https:\/\/plugins.trac.wordpress.org\/changeset\/3334424\/idonate\/tags\/2.1.10\/src\/Helpers\/DonorFunctions.php?old=3279142&old_path=idonate%2Ftags%2F2.1.9%2Fsrc%2FHelpers%2FDonorFunctions.php<\/p>\n IDonate – Blood Donation, Request And Donor Management System<\/a><\/p><\/blockquote>\nAffected Products<\/h2>\n
Current Status<\/h2>\n
Severity Level<\/h2>\n
Possible Solutions<\/h2>\n
References<\/h2>\n