CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
What the vulnerability does
The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Insecure Direct Object Reference via the admin_post_donor_delete() function in versions 2.0.0 to 2.1.9. By supplying an arbitrary user_id parameter value to the wp_delete_user() function, authenticated attackers, with Subscriber-level access and above could delete arbitrary user accounts, including those of administrators.
Explanation of Vulnerability in Simple Terms
IDonate versions 2.0.0 through 2.1.9 lack proper authorization checks, allowing authenticated users to modify data they should not have access to. An attacker with a low-privilege account can change or delete information belonging to other users or the system. The vulnerability requires valid login credentials but no additional user interaction.
What an attacker can do
Modify or delete blood donation records, donor information, or requests belonging to other users.
Potential impact on your site
Unauthorized changes to donation records, donor data loss, or system data corruption by authenticated users.
Conditions required to exploit
Attacker must have a valid login account with low-level privileges on the site.
Key dates
External resources
Related vulnerabilities
