CVE-2025-11154: The IDonate WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unauthenticated attackers…

PriorityP431medium5.4CVSS 3.1

AVNACLPRLUINSUCLILAN

EPSS

0.13%

3.0th percentile

The IDonate WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unauthenticated attackers to delete arbitrary users.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
themeatelier	idonate	< 2.1.13	2.1.13

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.