Listen to this Post
How the CVE works:
The vulnerability exists in the IDonate WordPress plugin’s panding_blood_request_action() function, which is hooked to WordPress AJAX handlers via wp_ajax_ and wp_ajax_nopriv_ actions. Due to a missing capability check, this function does not verify user permissions before executing. Attackers can send unauthenticated HTTP POST requests to the standard admin-ajax.php endpoint with the ‘action’ parameter set to ‘panding_blood_request_action’. By including a ‘post_id’ or similar parameter in the request, the function processes it and likely calls internal WordPress functions like wp_delete_post() to remove the specified post. The absence of authentication, authorization, and nonce validation allows any remote user to delete arbitrary posts. This flaw affects all plugin versions up to and including 2.1.15, leading to unauthorized data modification, content loss, and potential site disruption.
Platform: WordPress IDonate Plugin
Version: Up to 2.1.15
Vulnerability: Unauthenticated Post Deletion
Severity: Critical
Date: 11/22/2025
Prediction: Patch Version 2.1.16
What Undercode Say:
Analytics:
wp plugin list | grep idonate
curl -X POST “http://target.com/wp-admin/admin-ajax.php” -d “action=panding_blood_request_action&post_id=123”
function panding_blood_request_action() { $post_id = $_POST[‘post_id’]; wp_delete_post($post_id); }
How Exploit:
Send unauthenticated POST request to admin-ajax.php with action parameter set to panding_blood_request_action and post_id parameter specifying target post. No credentials required. Use curl or browser.
Protection from this CVE:
Update plugin immediately. Remove unused plugin. Implement WAF rules.
Impact:
Arbitrary post deletion. Data loss and corruption. Site functionality disruption.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
