← Back

CVE-2025-4523

nvd nist
Published: Aug 1, 2025Modified: Dec 5, 2025

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 2.8 / Impact: 3.6
Source: NVD

Description

The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the admin_donor_profile_view() function in versions 2.0.0 to 2.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to expose an administrator’s username, email address, and all donor fields.

Affected (1)

Themeatelier
1 product
Idonate
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Idonate
From 2.0.0 to 2.1.10

Related CWEs

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (5)

Source: security@wordfence.com
Product
Source: security@wordfence.com
Product
Source: security@wordfence.com
Product
Source: security@wordfence.com
Release Notes
Source: security@wordfence.com
PatchThird Party Advisory

Timeline

No history available yet.