CVE-2025-4522: Themeatelier Idonate

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Insecure Direct Object Reference via the admin_post_donor_delete() function in versions 2.0.0 to 2.1.9. By supplying an arbitrary user_id parameter value to the wp_delete_user() function, authenticated attackers, with Subscriber-level access and above could delete arbitrary user accounts, including those of administrators.

Affected products

• Themeatelier Idonate: from 2.0.0, before 2.1.10 (fixed in 2.1.10)

Published 2025-11-07. Last modified 2026-10-07.