CVE-2025-4522

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-4522

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-4522.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-4522

Published

2025-11-07T05:16:04.443Z

Modified

2026-03-15T14:13:41.329270Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

[none]

Details

The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Insecure Direct Object Reference via the adminpostdonordelete() function in versions 2.0.0 to 2.1.9. By supplying an arbitrary userid parameter value to the wpdeleteuser() function, authenticated attackers, with Subscriber-level access and above could delete arbitrary user accounts, including those of administrators.

References

Affected packages

Git /

Affected ranges

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-4522.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "2.0.0"
            },
            {
                "fixed": "2.1.10"
            }
        ]
    }
]