← Database

CVE-2025-11154

MEDIUM CVSS: 5.4 Published: 2025-10-27 Modified: 2026-06-17

Description

The IDonate WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unauthenticated attackers to delete arbitrary users.

Affected Platforms

Themeatelier Idonate

Weakness Type

CWE-352

References