CVE-2025-12877: Themeatelier Idonate Auth Bypass Flaw

CVE-2025-12877 Overview

CVE-2025-12877 affects the IDonate – Blood Donation, Request And Donor Management System plugin for WordPress. The vulnerability results from a missing capability check on the panding_blood_request_action() function in all versions up to and including 2.1.15. Unauthenticated attackers can invoke this AJAX handler to delete arbitrary posts on the target site. The flaw is classified under CWE-862: Missing Authorization. CVE-2025-67583 is likely a duplicate of this issue.

Critical Impact
Unauthenticated attackers can remotely delete arbitrary WordPress posts, causing integrity loss across affected sites.

Affected Products

ThemeAtelier IDonate – Blood Donation, Request And Donor Management System plugin for WordPress
All versions up to and including 2.1.15
WordPress sites using vulnerable IDonate deployments

Discovery Timeline

2025-11-22 - CVE-2025-12877 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12877

Vulnerability Analysis

The IDonate plugin exposes AJAX endpoints for managing blood donation requests. One of these handlers, panding_blood_request_action(), processes actions against pending blood request records. The function fails to verify the caller's WordPress capabilities before executing the requested operation. As a result, any unauthenticated visitor can trigger the endpoint and instruct it to delete WordPress posts by ID. This exposes site content, custom post types, and dependent workflows to unauthorized destruction.

Root Cause

The root cause is a missing authorization check ([CWE-862]) inside panding_blood_request_action(). The handler does not call current_user_can() or an equivalent capability guard, and it does not enforce a valid nonce tied to a privileged action. The vendor addressed the flaw in changesets 3398056 and 3400306 inside src/Helpers/IDonateAjaxHandler.php.

Attack Vector

An attacker sends a crafted HTTP POST request to the WordPress admin-ajax.php endpoint invoking the vulnerable action and supplying a target post identifier. Because the handler is registered for both authenticated and unauthenticated hooks and skips capability checks, WordPress deletes the specified post. Attackers can script mass deletion across enumerated post IDs, damaging site integrity without requiring credentials or user interaction.

No verified public proof-of-concept code is available. Refer to the Wordfence Vulnerability Analysis and the WordPress Plugin Changeset Update for technical details.

Detection Methods for CVE-2025-12877

Indicators of Compromise

Unexpected POST requests to /wp-admin/admin-ajax.php referencing the panding_blood_request action from unauthenticated sessions.
WordPress audit logs showing post deletions with no associated administrator user context.
Sudden drops in published post counts or missing custom post type entries tied to the IDonate plugin.

Detection Strategies

Inspect web server access logs for repeated admin-ajax.php requests carrying IDonate action parameters from a single source IP.
Enable a WordPress activity logging plugin to capture post deletion events and correlate them with request source identity.
Compare the installed plugin version against 2.1.15 and flag any host running an equal or lower release.

Monitoring Recommendations

Alert on HTTP 200 responses to admin-ajax.php where the action name matches known IDonate handlers and no authentication cookie is present.
Monitor database change events for wp_posts deletions occurring outside scheduled maintenance windows.
Track outbound plugin file modification events on src/Helpers/IDonateAjaxHandler.php to confirm patch application.

How to Mitigate CVE-2025-12877

Immediate Actions Required

Update the IDonate plugin to the patched release published in changeset 3400306 immediately.
Audit wp_posts for missing or unexpectedly deleted entries and restore from backup where required.
Restrict access to admin-ajax.php at the web application firewall for unauthenticated IDonate action names until patching completes.

Patch Information

ThemeAtelier resolved the missing capability check in the IDonate plugin through WordPress.org changesets 3398056 and 3400306, which add the missing authorization check to IDonateAjaxHandler.php. Site administrators should upgrade to any release later than 2.1.15.

Workarounds

Deactivate and remove the IDonate plugin until the site can be upgraded to a patched version.
Deploy a WAF rule that blocks unauthenticated POST requests targeting IDonate AJAX action names on admin-ajax.php.
Maintain frequent database backups so deleted posts can be restored quickly if exploitation occurs.

bash

# Example WAF rule blocking unauthenticated IDonate AJAX actions
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1012877,msg:'Block IDonate unauth action'"
  SecRule ARGS:action "@rx ^panding_blood_request" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"