CVE-2025-4522: IDonate 2.0.0 - 2.1.9 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion via admin_post_donor_delete Function
The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Insecure Direct Object Reference via the adminpostdonordelete() function in versions 2.0.0 to 2.1.9. By supplying an arbitrary userid parameter value to the wpdeleteuser() function, authenticated attackers, with Subscriber-level access and above could delete arbitrary user accounts, including those of administrators.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4522?
CVE-2025-4522 has a medium severity as it allows for insecure direct object references that could compromise user accounts.
How do I fix CVE-2025-4522?
To fix CVE-2025-4522, update the IDonate plugin to the latest version beyond 2.1.9.
What systems are affected by CVE-2025-4522?
CVE-2025-4522 affects versions 2.0.0 through 2.1.9 of the IDonate – Blood Donation, Request And Donor Management System plugin for WordPress.
Who is impacted by CVE-2025-4522?
Users of the IDonate plugin on their WordPress sites could be impacted by CVE-2025-4522 if their installations are within the affected version range.
What exploits are possible with CVE-2025-4522?
Exploiting CVE-2025-4522 could allow an attacker to perform unauthorized deletion of user accounts by manipulating the user_id parameter.