Overview
A critical security vulnerability has been identified in the IDonate – Blood Donation, Request And Donor Management System plugin for WordPress. Designated as CVE-2025-12877, this flaw allows unauthenticated attackers to delete arbitrary posts within the WordPress installation. This vulnerability affects all versions of the plugin up to and including version 2.1.15. Immediate action is required to mitigate this risk.
Technical Details
The vulnerability stems from a missing capability check within the panding_blood_request_action() function. Specifically, the plugin fails to verify whether a user has the necessary permissions before allowing them to execute this function. As a result, an unauthenticated attacker can craft a malicious request to trigger the deletion of any post on the WordPress site. This is possible due to the lack of authentication and authorization controls for this function.
CVSS Analysis
The vulnerability has been assigned a CVSS score of 5.3 (Medium). This score reflects the potential impact of the vulnerability, considering factors such as the ease of exploitation and the potential damage that can be inflicted.
Possible Impact
The impact of this vulnerability can be significant. An attacker exploiting CVE-2025-12877 can:
- Delete any post on the WordPress site, including critical content like blog posts, pages, and custom post types.
- Cause data loss and disrupt website functionality.
- Damage the website’s reputation and SEO ranking.
- Potentially use the compromised site as part of a larger attack.
Mitigation or Patch Steps
The vulnerability has been addressed in a later version of the plugin. To mitigate the risk, follow these steps:
- Update the IDonate Plugin: The most effective solution is to update the IDonate – Blood Donation, Request And Donor Management System plugin to the latest available version. Ensure you are running a version greater than 2.1.15.
- Monitor Website Activity: Keep a close watch on your WordPress website for any suspicious activity, such as unexpected post deletions.
