CVE-2022-40312 MEDIUM

CVE-2022-40312: WordPress GiveWP Plugin <= 2.25.1 is vulnerable to Server Side Request Forgery (SSRF)

Vendor Givewp
Product GiveWP – Donation Plugin and Fundraising Platform
Weakness CWE-918 · SSRF
Published December 18, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.5/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Server-Side Request Forgery (SSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.1.

Explanation of Vulnerability in Simple Terms

02Summary

GiveWP versions up to 2.25.1 contain a server-side request forgery vulnerability that allows high-privilege users to make the site send HTTP requests to internal or external systems on their behalf. The attacker must have administrator-level access and the impact is limited to information disclosure and minor integrity changes. Update to a version newer than 2.25.1.

What an attacker can do

03Attacker Capabilities

Make the site send HTTP requests to internal systems or external servers to read data or perform actions.

Potential impact on your site

04Site Impact

A compromised admin account could be used to probe your internal network or exfiltrate data via the plugin.

Conditions required to exploit

05Prerequisites

Attacker must have administrator-level access to the WordPress site.

Key dates

06Disclosure timeline

December 18, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57348 WordPress Paid Member Subscriptions plugin <= 3.0.4 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-7049 PixelYourSite Pro <= 12.5.0.1 - Unauthenticated Blind Server-Side Request Forgery via 'urls[]' Parameter CVE-2026-39647 WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.11 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-57681 WordPress GeoDirectory plugin <= 2.8.161 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-3216 Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017