CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the give_update_payment_status() function in all versions up to, and including, 4.5.0. This makes it possible for authenticated attackers, with GiveWP Worker-level access and above, to update donations statuses. This ability is not present in the user interface.
Explanation of Vulnerability in Simple Terms
GiveWP versions up to 4.5.0 contain an improper access control vulnerability that allows authenticated users with low privileges to modify data they should not have access to. The vulnerability requires a valid user account but no special interaction. An attacker can alter donation records or plugin settings through direct API or form manipulation. Update to a version newer than 4.5.0 to resolve this issue.
What an attacker can do
Modify donation records, settings, or other data without proper authorization.
Potential impact on your site
Donation data integrity compromised; attackers with basic accounts can alter records or plugin configuration.
Conditions required to exploit
Attacker must have a low-privilege user account on the site (e.g., subscriber or donor).
Key dates
External resources
Related vulnerabilities
