CVE-2025-4523: Themeatelier Idonate

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the admin_donor_profile_view() function in versions 2.0.0 to 2.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to expose an administrator’s username, email address, and all donor fields.

Affected products

• Themeatelier Idonate: from 2.0.0, before 2.1.10 (fixed in 2.1.10)

Published 2025-08-01. Last modified 2026-06-17.