Volerion logoVolerion
Volerion logoVolerion

IDonate WordPress Plugin Unauthenticated User Deletion Vulnerability

Vulnerability

A vulnerability in the IDonate WordPress plugin, affecting versions prior to 2.1.13, allows unauthenticated attackers to delete arbitrary users. This issue arises from a lack of authorization and cross-site request forgery (CSRF) protection when users are deleted via an action handler.

Impact

Exploitation of this vulnerability allows for the unauthorized deletion of users.

Reproduction

To reproduce this vulnerability, send a POST request to 'wp-admin/admin-ajax.php' with the 'action' parameter set to 'panding_donor_action', the 'target' parameter set to 'delete', and the 'userid' parameter set to a valid numeric User ID. The absence of authorization and CSRF protection in the IDonate WordPress plugin prior to version 2.1.13 enables this exploitation.

Remediation

Users are advised to update the IDonate WordPress plugin to version 2.1.13 or later.

Added: Oct 27, 2025, 6:23 AM
Updated: Oct 27, 2025, 2:41 PM

Vulnerability Rating

Custom Algorithm
spread
2.2
impact
2.5
exploitability
9.7
remediation
7.7
relevance
0.8
threat
6.4
urgency
2.9
incentive
10.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.