Vulnerability record · CVE-2025-12877 · published 22 November 2025

CVE-2025-12877: Themeatelier idonate missing authorization vulnerability

Themeatelier · Idonate

The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized modification od data due to a missing capability check on the panding_blood_request_action() function in all versions up to, and including, 2.1.15. This makes it possible for unauthenticated attackers to delete arbitrary posts. CVE-2025-67583 is likely a duplicate of this.

5.3 CVSS 3.1 Medium EPSS 0.27% · top 82.8% CWE-862 · Missing authorization

5.3CVSS 3.1 base score

0.27%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

3References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Idonate Themeatelier

References

Link	Tags
https://plugins.trac.wordpress.org/changeset/3398056/idonate/trunk/src/Helpers/IDonateAjaxHandler.php?old=3372718&old_pa	Patch
https://plugins.trac.wordpress.org/changeset/3400306/idonate/trunk/src/Helpers/IDonateAjaxHandler.php?old=3372718&old_pa	Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/96bd997f-63d5-47a7-b433-486c1113b44b?source=cve	PatchThird Party Advisory

Track CVE-2025-12877 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-32519Themeatelier idonate php remote file inclusion vulnerabilityImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Foysal Imran IDonate idonate…EPSS 0.90%11 Apr 2025 8.8CVE-2025-4519Themeatelier idonate improper authorization vulnerabilityThe IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Privilege Escalation due to a missing capabil…EPSS 0.34%7 Nov 2025 8.7CVE-2024-3594Themeatelier idonate cross-site scripting vulnerabilityThe IDonate WordPress plugin through 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to…EPSS 0.52%23 May 2024 6.5CVE-2025-4522Themeatelier idonate missing authorization vulnerabilityThe IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Insecure Direct Object Reference via the admi…EPSS 0.25%7 Nov 2025 6.5CVE-2025-4523Themeatelier idonate information exposure vulnerabilityThe IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized access of data due to a missing …EPSS 0.31%1 Aug 2025 5.4CVE-2025-11154Themeatelier idonate cross-site request forgery vulnerabilityThe IDonate WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unauthenticated a…EPSS 0.13%27 Oct 2025 5.3CVE-2025-67583Themeatelier idonate missing authorization vulnerabilityMissing Authorization vulnerability in Foysal Imran IDonate idonate allows Exploiting Incorrectly Configured Access Control Security Levels.This issu…EPSS 0.21%9 Dec 2025 9.9CVE-2026-84869ScreenConnect client allows unauthorized file transfer and execution in remote sessionsA flaw in the ConnectWise ScreenConnect client lets files be transferred and executed inside an active remote session without authorization or Host c…KEVEPSS 0.92%analysed8 Sep 2026

Source: NIST National Vulnerability Database (record CVE-2025-12877), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.