Sensitive Information Exposure in GiveWP Plugin for WordPress
CVE-2025-2331

5.3MEDIUM

Key Information:

Vendor
WordPress
Status
GiveWP – Donation Plugin And Fundraising Platform
Vendor
CVE Published:
22 March 2025

Summary

The GiveWP plugin for WordPress exhibits a vulnerability that allows authenticated attackers with Subscriber-level access to misconfigured capability checks. This flaw enables them to access and extract sensitive information, including donation records and donor reports, compromising user data security. All versions prior to 3.22.1 are affected, highlighting the need for immediate updates to secure sensitive data against unauthorized access.

Affected Version(s)

GiveWP – Donation Plugin and Fundraising Platform * <= 3.22.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/give/trunk/src...
https://plugins.trac.wordpress.org/browser/give/trunk/src...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Brian Sans-Souci
.