CVE-2025-4523

Description

The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the admin_donor_profile_view() function in versions 2.0.0 to 2.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to expose an administrator’s username, email address, and all donor fields.

PUBLISHED Reserved 2025-05-09 | Published 2025-08-01 | Updated 2025-08-01 | Assigner Wordfence

Problem types

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Product status

Timeline

Credits

Kenneth Dunn finder

References

www.wordfence.com/...-9d70-44b7-a347-3922c0b8684c?source=cve

plugins.trac.wordpress.org/...tags/2.1.9/src/Admin/Admin.php

wordpress.org/plugins/idonate/

plugins.trac.wordpress.org/...Helpers/IDonateAjaxHandler.php

plugins.trac.wordpress.org/changeset/3334424/

cve.org (CVE-2025-4523)

nvd.nist.gov (CVE-2025-4523)