The vulnerability identified as CVE-2025-4521 affects the IDonate – Blood Donation, Request And Donor Management System plugin for WordPress, specifically versions 2.1.5 through 2.1.9. It is categorized under CWE-285, indicating improper authorization. The root cause is a missing capability check in the idonate_donor_profile() function, which is responsible for handling donor profile updates. Authenticated users with minimal privileges (Subscriber-level or above) can exploit this flaw by supplying a donor_id parameter to reassign the email address of any user account. Once the email is reassigned, the attacker can initiate a password reset process, effectively taking over the targeted account. This attack path does not require user interaction beyond authentication, and the vulnerability is remotely exploitable over the network. The CVSS v3.1 score is 8.8 (high), reflecting the critical impact on confidentiality, integrity, and availability, as the attacker gains full administrative control over the WordPress site. The plugin is typically used by organizations managing blood donation and donor requests, which may contain sensitive personal and health data. No patches are currently linked, and no known exploits have been reported in the wild, but the vulnerability's nature suggests it could be weaponized quickly once publicized.

For European organizations, the impact of this vulnerability is significant. Blood donation and healthcare-related entities using the IDonate plugin risk unauthorized administrative access, which can lead to the exposure of sensitive donor personal and medical information, violating GDPR and other privacy regulations. Full admin control allows attackers to manipulate website content, disrupt services, or deploy malware, potentially damaging organizational reputation and trust. Healthcare providers and NGOs involved in blood donation campaigns across Europe could face operational disruptions and legal consequences due to data breaches. The ease of exploitation from a low-privilege account increases the threat surface, especially in environments where user registration is open or loosely controlled. This vulnerability also poses risks to the integrity of donation records and requests, which are critical for patient care and emergency response coordination.

European organizations should immediately audit their WordPress installations for the presence of the vulnerable IDonate plugin versions 2.1.5 to 2.1.9. If an updated, patched version is released, applying it should be the top priority. In the absence of a patch, administrators should consider disabling or uninstalling the plugin temporarily. Restrict user registration and enforce strict access controls to limit Subscriber-level account creation. Implement monitoring and alerting for unusual password reset requests or email changes. Employ Web Application Firewalls (WAFs) with custom rules to detect and block attempts to exploit the donor_id parameter in the idonate_donor_profile() function. Conduct regular security audits and penetration tests focusing on privilege escalation vectors. Additionally, enforce multi-factor authentication (MFA) for all administrative accounts to reduce the risk of account takeover. Backup all site data and configurations regularly to enable rapid recovery if compromise occurs.