The IDonate Blood Donation, Request And Donor Management System plugin for WordPress contains a missing capability check in the panding_blood_request_action() function. Because the plugin does not verify the caller’s privileges, an unauthenticated user can invoke the AJAX endpoint and delete arbitrary posts from the site. The vulnerability allows complete loss of content without any authentication or authorization controls, directly compromising data integrity for any site that relies on the plugin to store donation requests or donor records.

WordPress sites that have installed the IDonate plugin version 2.1.15 or earlier, including all releases up to 2.1.15, run the risk. The affected product is identified by the vendor faysal61’s IDonate plugin. Any WordPress installation that has not applied a version update beyond 2.1.15 is vulnerable.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of current exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can exploit it by sending an unauthenticated AJAX request to the plugin's endpoint; no special privileges or prior compromise are required, making the attack path straightforward for an external attacker with network visibility to the site.