CVE-2025-11154
📋 TL;DR
The IDonate WordPress plugin before version 2.1.13 lacks proper authorization and CSRF protection in its user deletion functionality, allowing unauthenticated attackers to delete arbitrary user accounts. This affects all WordPress sites running vulnerable versions of the IDonate plugin.
💻 Affected Systems
- IDonate WordPress Plugin
📦 What is this software?
Idonate by Themeatelier
⚠️ Risk & Real-World Impact
Worst Case
Attackers delete all user accounts including administrators, causing complete loss of access and potential site takeover if backups are unavailable.
Likely Case
Attackers delete key user accounts (administrators, editors) causing operational disruption and requiring manual account restoration.
If Mitigated
No impact if plugin is patched or proper web application firewalls block the exploit attempts.
🎯 Exploit Status
Exploitation requires sending crafted HTTP requests to the vulnerable endpoint without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.13
Vendor Advisory: https://wpscan.com/vulnerability/fdb9e076-4c65-4fd1-b1f6-23c23a11bdb7/
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find IDonate plugin
4. Click 'Update Now' if update is available
5. If no update appears, manually download version 2.1.13+ from WordPress repository
🔧 Temporary Workarounds
Disable IDonate Plugin
WordPressTemporarily deactivate the vulnerable plugin until patched
wp plugin deactivate idonate
Web Application Firewall Rule
allBlock requests to the vulnerable action handler endpoint
Block HTTP POST requests containing 'action=idonate_delete_user'
🧯 If You Can't Patch
- Implement strict network access controls to limit who can access the WordPress admin interface
- Enable comprehensive logging and monitoring for user deletion events
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → IDonate version numberCheck Version:
wp plugin get idonate --field=versionVerify Fix Applied:
Verify IDonate plugin version is 2.1.13 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual user deletion events
- POST requests to /wp-admin/admin-ajax.php with action=idonate_delete_user
Network Indicators:
- HTTP POST requests to admin-ajax.php with user deletion parameters from unauthenticated sources
SIEM Query:
source="wordpress.log" AND "action=idonate_delete_user"