CVE-2025-67583
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2Description
Missing Authorization vulnerability in Foysal Imran IDonate idonate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IDonate: from n/a through <= 2.1.15.
Analysis
Missing authorization controls in IDonate WordPress plugin through version 2.1.15 allows unauthenticated remote attackers to access sensitive information due to incorrectly configured access control security levels. The vulnerability has a low EPSS score (0.04%, 13th percentile) and no public exploit code or active exploitation is documented, indicating limited real-world attack incentive despite network-accessible attack surface.
Technical Context
IDonate is a WordPress plugin (CPE: cpe:2.3:a:themeatelier:idonate:*:*:*:*:*:wordpress:*:*) that implements access control mechanisms to protect sensitive functionality. The vulnerability stems from CWE-862 (Missing Authorization), a fundamental failure in the plugin's authorization logic where access control checks are either absent or incorrectly configured. This allows the security levels designed to restrict access to certain features or data to be bypassed by attackers without valid credentials. WordPress plugins are executed server-side with direct database and file system access, making authorization failures particularly significant in this context.
Affected Products
IDonate WordPress plugin by Foysal Imran (vendored as themeatelier:idonate) through version 2.1.15 is affected. The vulnerability impacts all installations of this plugin up to and including the 2.1.15 release. Additional version ranges prior to 2.1.15 are also vulnerable, though the exact earliest affected version is not specified. Full details are available in the Patchstack vulnerability database: https://patchstack.com/database/Wordpress/Plugin/idonate/vulnerability/wordpress-idonate-plugin-2-1-15-broken-access-control-vulnerability?_s_id=cve
Remediation
Update IDonate to a version newer than 2.1.15 as soon as a patched release becomes available from the plugin vendor (Foysal Imran). Check the official WordPress Plugin Directory or the plugin's GitHub repository for the latest version. Until a patched version is released, consider disabling or removing the IDonate plugin if not actively required, or implementing network-level access controls to restrict access to the WordPress installation to trusted IP ranges. Review the plugin's access control settings to ensure that security levels are correctly configured per the vendor's documentation. Consult the Patchstack security advisory for additional recommendations: https://patchstack.com/database/Wordpress/Plugin/idonate/vulnerability/wordpress-idonate-plugin-2-1-15-broken-access-control-vulnerability?_s_id=cve
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today