Idonate
CVE-2025-67583
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Missing Authorization vulnerability in Foysal Imran IDonate idonate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IDonate: from n/a through <= 2.1.15.
AnalysisAI
Missing authorization controls in IDonate WordPress plugin through version 2.1.15 allows unauthenticated remote attackers to access sensitive information due to incorrectly configured access control security levels. The vulnerability has a low EPSS score (0.04%, 13th percentile) and no public exploit code or active exploitation is documented, indicating limited real-world attack incentive despite network-accessible attack surface.
Technical ContextAI
IDonate is a WordPress plugin (CPE: cpe:2.3:a:themeatelier:idonate:*:*:*:*:*:wordpress:*:*) that implements access control mechanisms to protect sensitive functionality. The vulnerability stems from CWE-862 (Missing Authorization), a fundamental failure in the plugin's authorization logic where access control checks are either absent or incorrectly configured. This allows the security levels designed to restrict access to certain features or data to be bypassed by attackers without valid credentials. WordPress plugins are executed server-side with direct database and file system access, making authorization failures particularly significant in this context.
RemediationAI
Update IDonate to a version newer than 2.1.15 as soon as a patched release becomes available from the plugin vendor (Foysal Imran). Check the official WordPress Plugin Directory or the plugin's GitHub repository for the latest version. Until a patched version is released, consider disabling or removing the IDonate plugin if not actively required, or implementing network-level access controls to restrict access to the WordPress installation to trusted IP ranges. Review the plugin's access control settings to ensure that security levels are correctly configured per the vendor's documentation. Consult the Patchstack security advisory for additional recommendations: https://patchstack.com/database/Wordpress/Plugin/idonate/vulnerability/wordpress-idonate-plugin-2-1-15-broken-access-control-vulnerability?_s_id=cve
The IDonate WordPress plugin through 1.9.0 does not sanitise and escape some of its settings, which could allow high pri
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in
The IDonate - Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized mod
The IDonate - Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Insecure Direct
The IDonate - Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Privilege Escala
The IDonate - Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized acc
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today