CVE-2025-4571
GiveWP – Donation Plugin and Fundraising Platform <= 4.3.0 - Missing Authorization To Authenticated (Contributor+) Campaign Data View And Modification
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized view and modification of data due to an insufficient capability check on the permissionsCheck functions in all versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to view or delete fundraising campaigns, view donors' data, modify campaign events, etc.
| CWE | CWE-862 |
| Vendor | stellarwp |
| Product | givewp – donation plugin and fundraising platform |
| Published | Jun 19, 2025 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for stellarwp givewp – donation plugin and fundraising platform
Be the first to know when new medium vulnerabilities affecting stellarwp givewp – donation plugin and fundraising platform are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
stellarwp / GiveWP – Donation Plugin and Fundraising Platform
0 ≤ 4.3.0
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/8f03b4ef-e877-430e-a440-3af0feca818c?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/give/tags/4.2.0/src/Campaigns/ListTable/Routes/DeleteCampaignListTable.php#L40 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/give/tags/4.2.0/src/EventTickets/Routes/UpdateEvent.php#L36 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/give/tags/4.2.0/src/Campaigns/ListTable/Routes/GetCampaignsListTable.php#L95 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/give/tags/4.2.0/src/Donors/Endpoints/ListDonors.php#L31 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/give/tags/4.2.0/src/Donors/Endpoints/Endpoint.php#L57 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/give/tags/4.2.0/src/API/Endpoints/Logs/GetLogs.php#L40 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/give/tags/4.2.0/src/API/Endpoints/Logs/Endpoint.php#L26 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3305112/
Credits
Brian Sans-Souci