CVE-2025-32519 is a high severity (CVSS 8.1) PHP file inclusion flaw in the IDonate WordPress plugin by Foysal Imran, through version 2.1.18. It allows local file inclusion by controlling the filename used in an include statement. The record names no fixed version, so update to the newest release or remove the plugin.
What's affected
IDonate for WordPress, all versions through 2.1.18 per the CVE record. The record is based on a Patchstack report and does not state a fixed release, so check the plugin's change log for the first version after 2.1.18.
The record describes improper control of the filename passed to an include or require statement in PHP. It lists the effect as local file inclusion. The attack complexity is rated high, which keeps the score at 8.1 instead of higher.
The plugin adds donation forms to a site, so it is likely to be active on public pages. Check staging and old sites as well.
How to check if you're exposed
Read the installed version with WP-CLI:
wp plugin get idonate
Or open the Plugins page in the WordPress admin and read the version below the plugin name. Anything at 2.1.18 or lower is in scope.
If you manage many sites, run the same command through your management tooling and collect the results in one list.
What to do now
- Update IDonate to the latest version from the WordPress plugin directory or the vendor.
- If no fixed version exists, deactivate and delete the plugin and use another donation method.
- Keep file permissions tight so the web server user cannot read files it does not need.
- Check web logs for odd requests to the plugin's paths with file path style values.
- Turn on automatic updates for plugins that handle public input, where your change policy allows it.
Why it matters
The class is CWE-98 (PHP File Inclusion). A script picks a file to load using a value the caller can influence. In the local variant, the attacker steers the include toward files already on the server. Depending on what is on disk and what the process can read, the results range from disclosure of configuration to code execution.
The high attack complexity in the vector matters. It suggests conditions must line up for an attack to work. It does not make the plugin safe, because those conditions are hard to rule out from the outside.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild.
Try it yourself
WordPress plugin flaws are disclosed all the time, long after you installed the plugin. This demo shows how continuous monitoring flags a new CVE in something you already run.
Click through it at your own pace, or open it full screen.
Quick check
Does the attack need a login?
The vector shows no privileges required and no user interaction, but with high attack complexity. Treat any public site running the plugin as in scope.
Sources
Last reviewed: 18 October 2026.
