The IDonate WordPress plugin contains a critical privilege escalation vulnerability that allows authenticated attackers to gain full administrative control over the affected site.

The plugin fails to perform an adequate capability check on the idonate_donor_profile function. This allows an attacker with at least Subscriber-level privileges to modify the email address associated with any donor ID, enabling a password reset that results in full site compromise.

A successful exploitation of this vulnerability results in a total loss of confidentiality, integrity, and availability for the WordPress installation. With a CVSS score of 8.8, this flaw represents a High severity risk that could lead to unauthorized data access, total site takeover, and potential distribution of malware to site visitors.

Immediate Action: Update the IDonate plugin to version 2.1.10 or later immediately. If an update is not immediately available, deactivate the plugin until a secure version is deployed.

Proactive Monitoring: Review user account modification logs for suspicious activity, particularly changes to administrative email addresses or unexpected password reset requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized requests to the vulnerable endpoint and monitor for anomalous traffic patterns from low-privileged user accounts.

Public Exploit Available: No (exploit_available: false)

This vulnerability presents a severe risk to WordPress environments by enabling trivial privilege escalation. Administrators should prioritize patching the plugin to version 2.1.10 or higher across all affected instances without delay to prevent unauthorized administrative access.