CVE-2025-11154

IDonate < 2.1.13 - Unauthenticated User Deletion PUBLISHED

Description (CNA)

The IDonate WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unauthenticated attackers to delete arbitrary users.

Affected (CNA)

Vendor / product	Versions
Unknown / IDonate	affected 0 before 2.1.13

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/fdb9e076-4c65-4fd1-b1f6-23c23a11bdb7/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.