CVE-2024-5940: GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Unauthenticated Event Settings Update
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'handlerequest' function in all versions up to, and including, 3.13.0. This makes it possible for unauthenticated attackers to edit event ticket settings if the Events beta feature is enabled.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5940?
CVE-2024-5940 is rated as a high severity vulnerability due to the potential for unauthorized data modification.
How do I fix CVE-2024-5940?
To fix CVE-2024-5940, update the GiveWP – Donation Plugin and Fundraising Platform to version 3.14.0 or higher.
What is the impact of CVE-2024-5940 on my WordPress site?
The impact of CVE-2024-5940 includes potential unauthorized data modifications by unauthenticated users, compromising the integrity of donation records.
Which versions of the GiveWP plugin are affected by CVE-2024-5940?
CVE-2024-5940 affects all versions of the GiveWP plugin up to and including version 3.13.0.
Can unauthenticated users exploit CVE-2024-5940?
Yes, unauthenticated users can exploit CVE-2024-5940 to modify data on the affected WordPress sites.