CVE-2025-4519highCWE-285

CVE-2025-4519: falha de alta gravidade em themeatelier IDonate – Blood Donation, Request…

IDonate 2.1.5 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate_donor_password Function

Publicada em

Seguir esta CVE+ Monitorar IDonate – Blood Donation, Request And Donor Management System

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.4%
The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the idonate_donor_password() function in versions 2.1.5 to 2.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to initiate a password reset for any user (including administrators) and elevate their privileges for full site takeover.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
themeatelier · IDonate – Blood Donation, Request And Donor Management System
CVEs relacionadas — themeatelier IDonate – Blood Donation, Request…

No mesmo produto, das mais perigosas para as menos.

CVE-2025-4523MEDIUMIDonate 2.0.0 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via admin_donor_profile_view FunctionEPSS 0.4%CVE-2025-4521HIGHIDonate 2.1.5 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate_donor_profile FunctionEPSS 0.3%CVE-2025-4522MEDIUMIDonate 2.0.0 - 2.1.9 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion via admin_post_donor_delete FunctionEPSS 0.3%