CVE-2025-4519 Overview
CVE-2025-4519 is a privilege escalation vulnerability in the IDonate – Blood Donation, Request And Donor Management System plugin for WordPress. The flaw affects versions 2.1.5 through 2.1.9 and stems from a missing capability check on the idonate_donor_password() function. Authenticated attackers with Subscriber-level access or higher can initiate a password reset for any user, including administrators. Successful exploitation results in full site takeover.
Critical Impact
Any authenticated low-privilege user can reset an administrator password and seize full control of an affected WordPress site.
Affected Products
- ThemeAtelier IDonate plugin for WordPress, version 2.1.5
- ThemeAtelier IDonate plugin for WordPress, versions 2.1.6 through 2.1.8
- ThemeAtelier IDonate plugin for WordPress, version 2.1.9
Discovery Timeline
- 2025-11-07 - CVE-2025-4519 published to NVD
- 2025-12-04 - Last updated in NVD database
Technical Details for CVE-2025-4519
Vulnerability Analysis
The vulnerability is classified as Improper Authorization [CWE-285]. The idonate_donor_password() function in the IDonate plugin lacks a capability check before processing password reset requests. WordPress capability checks normally restrict sensitive actions to users holding specific roles. Without this check, the function trusts the supplied user identifier and proceeds with the password change. An attacker authenticated as a Subscriber can target the administrator account and replace its password with one they control. After login as the administrator, the attacker can install plugins, modify content, exfiltrate data, and pivot to the underlying host.
Root Cause
The root cause is a missing authorization check in idonate_donor_password() within src/Helpers/DonorFunctions.php. The function should call current_user_can() with an appropriate capability such as edit_users or restrict execution to the account owning the target user ID. Neither validation is present in versions 2.1.5 through 2.1.9. The fix landed in version 2.1.10 via WordPress Plugin Change Log.
Attack Vector
The attack vector is network-based and requires only Subscriber-level authentication. WordPress sites that allow open user registration expose this attack surface to anyone on the internet. An attacker registers an account, authenticates, and submits a crafted request to the plugin's password reset handler. The handler accepts a target user ID and a new password without verifying the requestor's authority. See the vulnerable source at WordPress Plugin Source Code.
No public proof-of-concept exploit code is available at the time of writing. The vulnerability mechanism is described in the Wordfence Vulnerability Report.
Detection Methods for CVE-2025-4519
Indicators of Compromise
- Unexpected administrator password changes recorded in WordPress audit logs or user meta last_update timestamps.
- New administrator-level accounts or role escalations following a Subscriber registration event.
- Plugin or theme installations originating from accounts that previously held only Subscriber privileges.
- Outbound requests to attacker-controlled infrastructure shortly after an administrator login from an unusual IP address.
Detection Strategies
- Monitor WordPress wp_users and wp_usermeta tables for unauthorized password hash changes against administrator accounts.
- Inspect web server access logs for POST requests targeting IDonate plugin endpoints handling donor password operations.
- Correlate authentication events to flag Subscriber accounts that successfully authenticate as administrators shortly afterward.
Monitoring Recommendations
- Enable a WordPress audit logging plugin to capture user updates, role changes, and plugin installations.
- Forward WordPress and web server logs to a centralized logging platform with alerting on privilege changes.
- Track plugin inventory and version drift to confirm rapid patching of IDonate to 2.1.10 or later.
How to Mitigate CVE-2025-4519
Immediate Actions Required
- Update the IDonate plugin to version 2.1.10 or later on all WordPress sites where it is installed.
- Audit administrator accounts for unauthorized password changes and reset credentials for all privileged users.
- Disable open user registration if it is not required, or restrict the default role assigned to new registrants.
- Review installed plugins, themes, and scheduled tasks for unauthorized additions following the patch deployment.
Patch Information
ThemeAtelier addressed the issue in IDonate version 2.1.10. The patch adds a capability check to idonate_donor_password() so that only authorized users can change another account's password. Review the upstream fix in the WordPress Plugin Change Log.
Workarounds
- Deactivate and remove the IDonate plugin until version 2.1.10 or later can be deployed.
- Restrict access to wp-admin and admin-ajax.php using IP allowlisting at the web server or web application firewall.
- Set default_role in WordPress settings to a non-privileged value and disable users_can_register if registration is not required.
# Configuration example: disable open registration and restrict default role via wp-cli
wp option update users_can_register 0
wp option update default_role subscriber
wp plugin update idonate --version=2.1.10
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
