CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the idonate_donor_password() function in versions 2.1.5 to 2.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to initiate a password reset for any user (including administrators) and elevate their privileges for full site takeover.
Explanation of Vulnerability in Simple Terms
IDonate versions 2.1.5 through 2.1.9 contain an improper access control vulnerability that allows authenticated users with low privileges to read, modify, or delete sensitive data and disrupt site operations. The vulnerability requires a valid user account but no additional user interaction. An attacker can escalate their capabilities beyond their intended role permissions.
What an attacker can do
Read, modify, or delete sensitive data; disrupt site availability with a valid low-privilege user account.
Potential impact on your site
Unauthorized data access, modification, or deletion; potential service disruption affecting blood donation management.
Conditions required to exploit
Attacker must have a valid user account with low privileges; no user interaction required.
Key dates
External resources
Related vulnerabilities
