IDonate 2.0.0 – 2.1.9 – Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via admin_donor_profile_view Function

Basic Information

Title	IDonate 2.0.0 – 2.1.9 – Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via admin_donor_profile_view Function
Type	cve
Published	2025-08-01T04:24:29.620Z
Modified	2025-08-01T04:24:29.620Z

Product Information

Vendor	themeatelier
Product	IDonate – Blood Donation, Request And Donor Management System
Version	2.0.0

The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the admin_donor_profile_view() function in versions 2.0.0 to 2.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to expose an administrator’s username, email address, and all donor fields.