CVE-2025-11154 Overview
CVE-2025-11154 affects the IDonate WordPress plugin developed by Themeatelier in versions before 2.1.13. The plugin exposes an action handler for deleting users without proper authorization checks or Cross-Site Request Forgery (CSRF) protection. Unauthenticated attackers can trigger the handler to delete arbitrary WordPress users on affected sites. The issue is classified under CWE-352 (Cross-Site Request Forgery).
Critical Impact
Attackers can delete arbitrary WordPress user accounts on vulnerable IDonate installations, disrupting site operations and destroying donor records.
Affected Products
- Themeatelier IDonate WordPress plugin versions prior to 2.1.13
- WordPress sites with the IDonate plugin activated
- Donation and charity sites relying on IDonate for donor management
Discovery Timeline
- 2025-10-27 - CVE-2025-11154 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11154
Vulnerability Analysis
The IDonate plugin registers an action handler that processes user deletion requests. The handler does not verify the requester's capability to delete users and does not validate a WordPress nonce. This combination allows the action to be invoked without authentication or a same-site request. An attacker can send a crafted request directly, or trick a browser into sending one, to remove users from the WordPress installation.
Successful exploitation removes user accounts, which can include administrators, donors, and contributors. Loss of accounts disrupts donation processing and can be used as a precursor to further compromise if attackers combine the deletion with account recreation flows.
Root Cause
The root cause is missing authorization and missing CSRF token validation in the delete-user action handler. WordPress provides current_user_can() for capability checks and wp_verify_nonce() (or check_admin_referer()) for CSRF protection. The vulnerable handler in IDonate versions before 2.1.13 invokes neither before performing the destructive operation.
Attack Vector
The attack is network-based and requires no prior authentication. An attacker can host a page that issues a GET or POST request to the vulnerable endpoint. When any visitor or authenticated administrator loads the page, the browser submits the request and the plugin deletes the targeted user. Alternatively, the attacker can call the endpoint directly against a target site. See the WPScan Vulnerability Report for further technical details.
Detection Methods for CVE-2025-11154
Indicators of Compromise
- Unexpected wp_users table entries missing after routine operation of the site
- Web server access logs containing requests to IDonate action handler endpoints from unauthenticated sources
- WordPress admin notifications of deleted accounts without matching administrator activity
- Referrer headers on delete requests pointing to unfamiliar external domains
Detection Strategies
- Audit WordPress plugin inventory for IDonate versions below 2.1.13
- Correlate user deletion events in WordPress audit logs with the originating HTTP request and session
- Alert on requests to plugin action endpoints that lack a valid _wpnonce parameter
- Review web application firewall (WAF) logs for cross-origin POST requests targeting admin-ajax.php or plugin action URLs
Monitoring Recommendations
- Enable a WordPress activity logging plugin to record user deletion events with timestamps and source IP addresses
- Forward web server and WordPress audit logs to a centralized SIEM for correlation across sessions and users
- Monitor for sudden drops in the user count within the WordPress database
- Track HTTP referrer and origin headers on state-changing plugin requests to detect CSRF patterns
How to Mitigate CVE-2025-11154
Immediate Actions Required
- Update the IDonate plugin to version 2.1.13 or later on all WordPress installations
- Restore deleted user accounts from database backups if unauthorized deletions are confirmed
- Rotate administrator credentials and review remaining user accounts for tampering
- Deploy WAF rules blocking cross-origin requests to IDonate action handlers until patching is complete
Patch Information
Themeatelier addressed the vulnerability in IDonate version 2.1.13. The fix adds authorization checks and CSRF nonce validation to the user deletion action handler. Site operators should apply the update through the WordPress plugin manager or by replacing the plugin directory with the patched release. Confirm the installed version via wp plugin list or the WordPress admin dashboard after upgrading.
Workarounds
- Deactivate the IDonate plugin until the patched version can be installed
- Restrict access to wp-admin/admin-ajax.php and IDonate endpoints using IP allow-listing at the web server or WAF
- Enforce origin and referrer header validation for state-changing requests via reverse proxy rules
- Reduce blast radius by limiting the number of accounts with the delete_users capability
# Configuration example: update IDonate via WP-CLI
wp plugin update idonate --version=2.1.13
wp plugin list --name=idonate --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
