Skip to content
Sign in
5.4 Medium

CVE-2025-11154 The IDonate WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action…

Description

The IDonate WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unauthenticated attackers to delete arbitrary users.

Affected products and versions

Product Affected versions Fixed in
IDonate 2.1 earliest → < 2.1.13 2.1.13

Other CVEs of IDonate

The 2 CVEs of IDonate →
CVE-2024-3594 The IDonate WordPress plugin through 1.9.0 does not sanitise and escape some of its settings, which could allow high… 8.7 High
Track this CVE