PT-2025-40615 · WordPress · Givewp – Donation Plugin/Fundraising Platform

Rafshanzani Suhada · CVE-2025-11227 · Publicado 2025-10-04 · Atualizado 2025-10-04

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GiveWP – Donation Plugin and Fundraising Platform versions prior to 4.10.1

Description The GiveWP – Donation Plugin and Fundraising Platform for WordPress is subject to Information Exposure due to a missing capability check in the registerGetForm, registerGetForms, registerGetCampaign, and registerGetCampaigns functions. This allows unauthenticated attackers to extract data from private and draft donation forms, as well as archived campaigns via REST API endpoints.

Recommendations Update to version 4.10.1 or later.

Correção

Improper Authorization

Enumeração de Fraquezas

CWE-285

Identificadores relacionados

CVE-2025-11227

Produtos afetados

Givewp – Donation Plugin/Fundraising Platform

Referências · 11

• https://plugins.trac.wordpress.org/browser/give/tags/4.9.0/src/DonationForms/Routes/DonationFormsEntityRoute.php#L52 · Nota
• https://twitter.com/VolerionSec/status/1974314610346869001 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-11227 · Aviso do Fabricante
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3371948%40give&new=3371948%40give&sfp_email=&sfph_mail= · Correção
• https://twitter.com/VulmonFeeds/status/1974410599418183791 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/give/tags/4.9.0/src/API/REST/V3/Routes/Campaigns/RegisterCampaignRoutes.php#L60 · Nota
• https://plugins.trac.wordpress.org/browser/give/tags/4.9.0/src/API/REST/V3/Routes/Campaigns/RegisterCampaignRoutes.php#L91 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-11227 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/54db1807-69ff-445c-9e02-9abce9fd3940?source=cve · Nota
• https://t.me/CVEtracker/34071 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/give/tags/4.9.0/src/DonationForms/Routes/DonationFormsEntityRoute.php#L82 · Nota