Unauthorized Data Modification in GiveWP Donation Plugin for WordPress
CVE-2025-7221
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 21 August 2025
What is CVE-2025-7221?
The GiveWP Donation Plugin for WordPress suffers from a security flaw that allows improper data modification due to inadequate capability verification on the give_update_payment_status() function. This vulnerability affects all versions up to and including 4.5.0. As a result, authenticated users with Worker-level access can change donation statuses without proper authorization, a capability that is absent from the user interface, creating significant risks for data integrity and security. Protect your site by ensuring your plugin is updated to the latest version.
Affected Version(s)
GiveWP – Donation Plugin and Fundraising Platform * <= 4.5.0