CVE-2025-4523 Overview
CVE-2025-4523 affects the IDonate – Blood Donation, Request And Donor Management System plugin for WordPress. The vulnerability exists in versions 2.0.0 through 2.1.9 due to a missing capability check on the admin_donor_profile_view() function. Authenticated attackers with Subscriber-level access or above can exploit this flaw to retrieve administrator usernames, email addresses, and all donor record fields. The issue is classified as an information disclosure weakness under [CWE-200].
Critical Impact
Any authenticated WordPress user, including low-privileged Subscribers, can extract administrator credentials metadata and complete donor personally identifiable information (PII) from the plugin.
Affected Products
- ThemeAtelier IDonate plugin for WordPress, version 2.0.0
- ThemeAtelier IDonate plugin for WordPress, versions 2.0.1 through 2.1.8
- ThemeAtelier IDonate plugin for WordPress, version 2.1.9
Discovery Timeline
- 2025-08-01 - CVE-2025-4523 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-4523
Vulnerability Analysis
The IDonate plugin exposes an AJAX endpoint that routes to the admin_donor_profile_view() function. This handler returns donor profile data along with associated administrator account details. The function omits a WordPress capability check, so any authenticated session can invoke it regardless of role.
An attacker who registers a standard Subscriber account, which is the default WordPress role for self-registration, gains immediate access to sensitive data. Returned fields include the administrator username, administrator email address, and all donor record attributes such as blood type, phone number, address, and medical notes.
The vulnerability enables account takeover preparation. Administrator usernames and emails support targeted password spraying, credential stuffing, and phishing. Exposed donor PII creates regulatory exposure under GDPR, HIPAA-adjacent data handling rules, and similar frameworks.
Root Cause
The root cause is a missing authorization check in the AJAX handler registered by the plugin. The developer registered the action for authenticated users using wp_ajax_ but did not invoke current_user_can() or verify a valid nonce tied to administrative capabilities. See the WordPress Plugin Admin Code and WordPress Plugin Ajax Handler Code for the vulnerable implementation.
Attack Vector
Exploitation requires network access to the WordPress admin-ajax.php endpoint and a valid authenticated session at Subscriber level or higher. The attacker sends a POST request specifying the plugin's donor profile view action along with a donor identifier. The server responds with the full donor record and administrator metadata. No user interaction from an administrator is required. See the Wordfence Vulnerability Intelligence advisory for additional context.
No verified public exploit code is available. The vulnerability mechanism is described in prose because no realCodeExamples were supplied by the reporting source.
Detection Methods for CVE-2025-4523
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php referencing the IDonate donor profile view action from accounts with Subscriber or Contributor roles.
- Unusual volume of AJAX calls from a single low-privileged account enumerating sequential donor IDs.
- Outbound traffic patterns where donor data or administrator email strings appear in web server response bodies logged by a reverse proxy.
Detection Strategies
- Deploy web application firewall (WAF) rules that inspect admin-ajax.php requests for the IDonate donor profile action and validate the requester's role against expected administrative access.
- Correlate WordPress user role information with AJAX action names in access logs to identify low-privileged users invoking administrative endpoints.
- Monitor plugin version inventory across managed WordPress instances and flag any deployment running IDonate versions 2.0.0 to 2.1.9.
Monitoring Recommendations
- Enable verbose access logging on the WordPress front end and forward logs to a centralized SIEM for query and retention.
- Alert on new Subscriber account registrations followed within a short window by AJAX activity targeting the plugin.
- Track outbound email and login attempts against the exposed administrator account for signs of downstream credential attacks.
How to Mitigate CVE-2025-4523
Immediate Actions Required
- Update the IDonate plugin to a version above 2.1.9 that includes the capability check fix released in WordPress Changeset 3334424.
- Audit WordPress user accounts and disable open self-registration if it is not required for site operation.
- Rotate administrator credentials and enable multi-factor authentication (MFA) on all privileged WordPress accounts.
Patch Information
The vendor addressed the missing capability check in a subsequent release tracked by WordPress Changeset 3334424. Site administrators should upgrade through the WordPress plugin dashboard or by downloading the current version from the iDonate Plugin Developers Page. Verify the installed version equals or exceeds the patched release after applying updates.
Workarounds
- Disable the IDonate plugin until the patched version can be installed and tested in a staging environment.
- Restrict WordPress user registration to administrators only by setting the users_can_register option to 0 under General Settings.
- Apply a virtual patch at the WAF layer that blocks requests to the vulnerable AJAX action for any user without the manage_options capability.
# Configuration example: disable open registration and update the plugin via WP-CLI
wp option update users_can_register 0
wp plugin update idonate
wp plugin list --name=idonate --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
