CVE-2025-11154CWE-352csrf

CVE-2025-11154

Medium · published October 27, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
3.3
In the wild
Unconfirmed
What it is

The IDonate WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unauthenticated attackers to delete arbitrary users.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00143 · 3.3th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2025-10-27T10:15Z
Affected products (1)
ProductVersionsFixed in
themeatelier/idonate< 2.1.132.1.13
References (1)
https://wpscan.com/vulnerability/fdb9e076-4c65-4fd1-b1f6-23c23a11bdb7/ · [email protected]
EPSS history
Timeline
  • 27 OCT 06:00Z
    IDonate < 2.1.13 - Unauthenticated User Deletion
    cvelistv5