Insecure Direct Object Reference in IDonate Plugin for WordPress
CVE-2025-4522
6.5MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 7 November 2025
What is CVE-2025-4522?
The IDonate plugin for WordPress is susceptible to an Insecure Direct Object Reference, allowing authenticated attackers with Subscriber-level access and higher to delete arbitrary user accounts through the admin_post_donor_delete() function. This vulnerability arises from improper handling of the user_id parameter when passed to the wp_delete_user() function. As a result, attackers can inadvertently or maliciously remove critical user accounts, including administrators, jeopardizing the integrity and functionality of the system.
Affected Version(s)
IDonate – Blood Donation, Request And Donor Management System 2.0.0 <= 2.1.9