CVE-2025-4521: WordPress IDonate Privilege Escalation

CVE-2025-4521 Overview

The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress contains a critical Privilege Escalation vulnerability due to a missing capability check on the idonate_donor_profile() function in versions 2.1.5 to 2.1.9. This security flaw allows authenticated attackers with minimal Subscriber-level access to hijack any WordPress account, including administrator accounts, by exploiting a broken access control mechanism in the donor profile update functionality.

Critical Impact

Authenticated attackers with low-privilege Subscriber accounts can escalate to full administrator privileges by reassigning email addresses to arbitrary accounts and triggering password resets, leading to complete WordPress site compromise.

Affected Products

• IDonate – Blood Donation, Request And Donor Management System plugin version 2.1.5
• IDonate – Blood Donation, Request And Donor Management System plugin version 2.1.6 through 2.1.8
• IDonate – Blood Donation, Request And Donor Management System plugin version 2.1.9

Discovery Timeline

• 2026-02-19 - CVE-2025-4521 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2025-4521

Vulnerability Analysis

This vulnerability falls under CWE-285 (Improper Authorization), which occurs when an application fails to properly enforce access controls on restricted operations. The idonate_donor_profile() function in the IDonate plugin lacks the necessary capability checks that would verify whether the requesting user has appropriate permissions to modify donor profile data.

The attack chain involves three distinct phases: first, the attacker identifies a target account (typically an administrator); second, they exploit the unprotected profile update function to reassign that account's email address to one they control; and third, they initiate a standard WordPress password reset to gain access to the hijacked account. This sequence transforms a low-privilege authenticated session into full administrative control over the WordPress installation.

Root Cause

The root cause is a missing capability check (authorization verification) in the idonate_donor_profile() function located in src/Helpers/DonorFunctions.php. The vulnerable code at line 310 in version 2.1.9 processes profile update requests without validating that the current user has permission to modify the specified donor_id. This allows any authenticated user to supply an arbitrary donor_id parameter and modify that donor's associated email address, regardless of whether they own that profile.

Attack Vector

The attack exploits a network-accessible endpoint that processes profile updates. An attacker with Subscriber-level WordPress authentication can craft a malicious request to the idonate_donor_profile() function, specifying a donor_id belonging to an administrator account. By changing the administrator's email to an attacker-controlled address and subsequently requesting a password reset through WordPress's standard recovery mechanism, the attacker gains full administrative privileges. This attack requires no user interaction beyond the initial authentication and can be executed remotely.

The vulnerability mechanism involves the following attack flow:

1. The attacker registers or uses an existing Subscriber-level WordPress account
2. They identify the donor_id associated with an administrator account
3. They send a crafted request to the vulnerable endpoint, changing the administrator's email address
4. They trigger WordPress password reset for the administrator account
5. The reset email is sent to the attacker-controlled address, granting full access

For technical details, see the WordPress Plugin Code Review and the WordPress Plugin Changeset that addresses this issue.

Detection Methods for CVE-2025-4521

Indicators of Compromise

• Unexpected email address changes on administrator or high-privilege WordPress user accounts
• Password reset requests for administrator accounts followed by successful logins from unfamiliar IP addresses
• Unusual activity from Subscriber-level accounts accessing donor profile management endpoints
• Audit log entries showing profile modifications where the requesting user differs from the profile owner

Detection Strategies

• Monitor WordPress audit logs for profile update requests targeting donor IDs not associated with the requesting user
• Implement alerts for email address changes on privileged accounts, especially when initiated through plugin endpoints
• Deploy web application firewall (WAF) rules to detect and block requests to idonate_donor_profile() with mismatched user context
• Review access logs for patterns of password reset requests following donor profile modifications

Monitoring Recommendations

• Enable comprehensive logging on WordPress installations using the IDonate plugin
• Configure real-time alerts for administrator account email address modifications
• Establish baseline behavior for donor profile management endpoints and alert on anomalies
• Implement SentinelOne Singularity XDR to monitor endpoint activity and detect post-exploitation behaviors indicative of account takeover

How to Mitigate CVE-2025-4521

Immediate Actions Required

• Update the IDonate plugin to version 2.1.10 or later immediately
• Audit all WordPress user accounts for unauthorized email address changes
• Review administrator account activity logs for signs of compromise
• Force password resets for all privileged accounts as a precautionary measure
• Consider temporarily deactivating the IDonate plugin until the update can be applied

Patch Information

The vulnerability has been addressed in IDonate version 2.1.10. The patch implements proper capability checks in the idonate_donor_profile() function to verify that users can only modify their own donor profiles. The security fix can be reviewed in the WordPress Plugin Changeset. For additional vulnerability details, consult the Wordfence Vulnerability Report.

Workarounds

• Restrict user registration on WordPress sites to prevent attackers from obtaining Subscriber accounts
• Implement additional authorization checks at the web server or WAF level for the affected endpoint
• Remove Subscriber-level users who do not require access to the site until the patch is applied
• Deploy file integrity monitoring to detect any plugin modifications

# Configuration example
# Temporarily disable user registration in WordPress wp-config.php
define('DISALLOW_FILE_EDIT', true);

# Add to .htaccess to restrict access to the plugin endpoint (temporary mitigation)
# Note: This is a temporary workaround - apply the official patch as soon as possible
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} idonate.*donor.*profile [NC]
RewriteCond %{HTTP_COOKIE} !wordpress_logged_in.*admin [NC]
RewriteRule .* - [F,L]
</IfModule>