What is the CVSS score of CVE-2025-67583?

CVE-2025-67583 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Foysal Imran IDonate CVE-2025-67583

MEDIUM

Missing Authorization (CWE-862)

2025-12-09 audit@patchstack.com

Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 09, 2025 - 16:18 nvd

MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in Foysal Imran IDonate idonate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IDonate: from n/a through <= 2.1.15.

AnalysisAI

Missing authorization controls in IDonate WordPress plugin through version 2.1.15 allows unauthenticated remote attackers to access sensitive information due to incorrectly configured access control security levels. The vulnerability has a low EPSS score (0.04%, 13th percentile) and no public exploit code or active exploitation is documented, indicating limited real-world attack incentive despite network-accessible attack surface.

Technical ContextAI

IDonate is a WordPress plugin (CPE: cpe:2.3:a:themeatelier:idonate:*:*:*:*:*:wordpress:*:*) that implements access control mechanisms to protect sensitive functionality. The vulnerability stems from CWE-862 (Missing Authorization), a fundamental failure in the plugin's authorization logic where access control checks are either absent or incorrectly configured. This allows the security levels designed to restrict access to certain features or data to be bypassed by attackers without valid credentials. WordPress plugins are executed server-side with direct database and file system access, making authorization failures particularly significant in this context.

RemediationAI

Update IDonate to a version newer than 2.1.15 as soon as a patched release becomes available from the plugin vendor (Foysal Imran). Check the official WordPress Plugin Directory or the plugin's GitHub repository for the latest version. Until a patched version is released, consider disabling or removing the IDonate plugin if not actively required, or implementing network-level access controls to restrict access to the WordPress installation to trusted IP ranges. Review the plugin's access control settings to ensure that security levels are correctly configured per the vendor's documentation. Consult the Patchstack security advisory for additional recommendations: https://patchstack.com/database/Wordpress/Plugin/idonate/vulnerability/wordpress-idonate-plugin-2-1-15-broken-access-control-vulnerability?_s_id=cve