PT-2025-40616 · WordPress · Givewp – Donation Plugin/Fundraising Platform

Rafshanzani Suhada · Published 2025-10-04 · Updated 2025-10-04 · CVE-2025-11228

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions GiveWP – Donation Plugin and Fundraising Platform versions prior to 4.10.1

Description The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress has a flaw that allows unauthorized modification of data. A missing capability check within the registerAssociateFormsWithCampaign function permits unauthenticated attackers to associate any donation forms with any campaign.

Recommendations Update to version 4.10.1 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-11228

Affected Products

Givewp – Donation Plugin/Fundraising Platform

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-11228 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3371948%40give&new=3371948%40give&sfp_email=&sfph_mail= · Patch
• https://osv.dev/vulnerability/CVE-2025-11228 · Vendor Advisory
• https://plugins.trac.wordpress.org/browser/give/tags/4.9.0/src/DonationForms/Routes/DonationFormsEntityRoute.php#L131 · Note
• https://t.me/CVEtracker/34076 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1974408039517114698 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/ddf9a043-5eb6-46fd-88c2-0f5a04f73fc9?source=cve · Note
• https://twitter.com/VolerionSec/status/1974314133056061563 · Twitter Post