CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
What the vulnerability does
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.10.0 via the 'registerGetForm', 'registerGetForms', 'registerGetCampaign' and 'registerGetCampaigns' functions due to a missing capability check. This makes it possible for unauthenticated attackers to extract data from private and draft donation forms, as well as archived campaigns.
Explanation of Vulnerability in Simple Terms
GiveWP versions up to 4.10.0 contain an improper access control vulnerability that allows unauthenticated attackers to read and modify sensitive data over the network without user interaction. The vulnerability affects the donation plugin's core functionality and could expose donor information or alter donation records. Site administrators should update to a version newer than 4.10.0 immediately.
What an attacker can do
Read and modify sensitive donation data without logging in.
Potential impact on your site
Donor information and donation records may be exposed or altered by unauthorized parties.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
