Alex Joseph
Uncovering the GiveWP Information Exposure Vulnerability
In the digital landscape, where fundraising and online donations play a crucial role, the security of platforms like GiveWP is paramount. Recently, a significant security flaw, identified as CVE-2025-11227, was discovered in the popular GiveWP – Donation Plugin and Fundraising Platform for WordPress. This vulnerability could allow sensitive information to be exposed to unauthorized individuals, posing a risk to privacy and trust.
At its core, this vulnerability is an Information Exposure flaw. It means that certain private or draft donation forms, as well as archived campaigns, could have their data extracted by unauthenticated attackers. This exposure is possible due to a missing capability check within specific functions of the plugin. Essentially, the plugin failed to properly verify if a user had the necessary permissions before allowing access to certain data, making it accessible to anyone who knew how to ask for it.
CVE Details
This vulnerability is officially identified as CVE-2025-11227.
- Product: GiveWP – Donation Plugin and Fundraising Platform for WordPress
- Published Date: October 4, 2025
- Severity: Medium
- Status: Analyzed
Affected Products
The information exposure vulnerability impacts all versions of the GiveWP – Donation Plugin and Fundraising Platform for WordPress up to, and including, version 4.10.0. If you are running any version within this range, your installation may be susceptible to this issue.
Current Status
As of its last update on October 8, 2026, the status of CVE-2025-11227 is "Analyzed." This indicates that the vulnerability has been thoroughly reviewed and its impact understood by security researchers and the vendor.
Severity Level
The vulnerability has been assigned a Medium Severity rating with a CVSS score of 6.5. A medium severity level for an information exposure flaw means that while an attacker might not be able to directly take over your website or inject malicious code, they can access sensitive data that should otherwise be protected. For a donation platform, this could include details about campaigns, donors, or fundraising goals that were intended to remain private. This can lead to reputational damage, loss of donor trust, and potential compliance issues.
Possible Solutions
Given that the vulnerability affects all versions of GiveWP up to and including 4.10.0, the most crucial step for users is to update their plugin immediately. It is strongly advised to update your GiveWP plugin to a version *greater than 4.10.0* as soon as an official patched release becomes available. Always ensure you are running the latest stable version of all your WordPress plugins, themes, and the core WordPress software itself. Regularly checking for updates and applying them promptly is a fundamental practice in maintaining a secure website. Before any major updates, always create a full backup of your website.
References
- https://plugins.trac.wordpress.org/browser/give/tags/4.9.0/src/API/REST/V3/Routes/Campaigns/RegisterCampaignRoutes.php#L60
- https://plugins.trac.wordpress.org/browser/give/tags/4.9.0/src/API/REST/V3/Routes/Campaigns/RegisterCampaignRoutes.php#L91
- https://plugins.trac.wordpress.org/browser/give/tags/4.9.0/src/DonationForms/Routes/DonationFormsEntityRoute.php#L52
- https://plugins.trac.wordpress.org/browser/give/tags/4.9.0/src/DonationForms/Routes/DonationFormsEntityRoute.php#L82
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3371948%40give&new=3371948%40give&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/54db1807-69ff-445c-9e02-9abce9fd3940?source=cve
