Alex Joseph
Understanding the GiveWP Data Modification Flaw
A notable security vulnerability, identified as CVE-2025-11228, has been discovered in the GiveWP – Donation Plugin and Fundraising Platform for WordPress. This issue allows unauthorized individuals to alter important data within your donation setup. Specifically, the problem lies in a missing security check that affects the plugin’s registerAssociateFormsWithCampaign function. This oversight means that even without proper login credentials, an attacker could link any donation forms to any fundraising campaign on your WordPress site.
Such a vulnerability could disrupt your fundraising efforts by misdirecting donations or confusing donors. It’s crucial for website administrators and developers using GiveWP to understand this risk and take appropriate action to secure their platforms.
CVE Details
- Product: GiveWP – Donation Plugin and Fundraising Platform for WordPress
- Published: October 4, 2025
- Severity: Medium
- Status: Analyzed
Affected Products
The vulnerability impacts all versions of the GiveWP – Donation Plugin and Fundraising Platform for WordPress up to, and including, version 4.10.0. If your WordPress site is running any of these versions, it is susceptible to this flaw.
Current Status
The vulnerability has been thoroughly analyzed. This means security researchers have understood its nature and potential impact, and information regarding it is available to the public and affected parties.
Severity Level
This vulnerability carries a Medium severity rating, with a CVSS score of 5.3. A Medium severity indicates that while the vulnerability is not immediately critical or easily exploitable for full system compromise, it can still lead to significant unauthorized actions. In this case, the unauthorized modification of donation form associations can undermine the integrity of fundraising campaigns and create administrative headaches.
Possible Solutions
The most important step to protect your WordPress site from CVE-2025-11228 is to update your GiveWP plugin. This vulnerability stems from a missing capability check, which means the developers will have released a patch to add this essential security measure. It is highly recommended to update your GiveWP plugin to a version higher than 4.10.0 as soon as a stable update is available. Always back up your WordPress site before performing any plugin updates.
Regularly updating all your WordPress plugins, themes, and core installation is a fundamental cybersecurity practice. This ensures you benefit from the latest security fixes and performance improvements.
References
- https://plugins.trac.wordpress.org/browser/give/tags/4.9.0/src/DonationForms/Routes/DonationFormsEntityRoute.php#L131
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3371948%40give&new=3371948%40give&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ddf9a043-5eb6-46fd-88c2-0f5a04f73fc9?source=cve
