CVE-2025-4519: themeatelier idonate

csirt@kutim:~/threat-intel/cve/CVE-2025-4519

CVSS 8.8 · High EPSS 0,36%

Kerentanan Improper Authorization pada themeatelier idonate. Skor CVSS 3.1 8.8 (High) menurut wordfence.com.

Deskripsi (NVD)

The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the idonate_donor_password() function in versions 2.1.5 to 2.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to initiate a password reset for any user (including administrators) and elevate their privileges for full site takeover.

Rincian

Terbit di NVD: 7 November 2025
Terakhir diubah: 7 Oktober 2026
Status NVD: Analyzed
CVSS 3.1: 8.8 (High), sumber wordfence.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-285: Improper Authorization
EPSS (30 hari): 0,36% peluang dieksploitasi; lebih tinggi dari 28,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
themeatelier	idonate	Versi 2.1.5 hingga sebelum 2.1.10

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://plugins.trac.wordpress.org/changeset/3334424/idonate/tags/2.1.10/src/Helpers/DonorFunctions.php?old=32... patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/596aef67-582a-4506-bae9-c7be1899e47a?source=cve patch · advisory pihak ketiga
https://plugins.trac.wordpress.org/browser/idonate/tags/2.1.9/src/Helpers/DonorFunctions.php#L410 product
https://wordpress.org/plugins/idonate/#developers release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 8 Okt 2026, 12:26 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.