CVE-2022-2117: GiveWP – Donation Plugin and Fundraising Platform <= 2.20.2 - Sensitive Information Disclosure
The GiveWP plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.20.2 via the /donor-wall REST-API endpoint which provides unauthenticated users with donor information even when the donor wall is not enabled. This functionality has been completely removed in version 2.20.2.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-2117?
CVE-2022-2117 is a vulnerability in the GiveWP plugin for WordPress that allows unauthenticated users to access donor information.
What is the severity of CVE-2022-2117?
The severity of CVE-2022-2117 is medium with a CVSS score of 5.3.
How does CVE-2022-2117 affect the GiveWP plugin?
CVE-2022-2117 affects the GiveWP plugin by exposing donor information to unauthenticated users.
Which version of the GiveWP plugin is affected by CVE-2022-2117?
Versions up to and including 2.20.2 of the GiveWP plugin are affected by CVE-2022-2117.
How can I fix CVE-2022-2117?
To fix CVE-2022-2117, update the GiveWP plugin to version 2.21.0 or higher.