CVE-2025-11227: GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms and Campaigns Disclosure
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.10.0 via the 'registerGetForm', 'registerGetForms', 'registerGetCampaign' and 'registerGetCampaigns' functions due to a missing capability check. This makes it possible for unauthenticated attackers to extract data from private and draft donation forms, as well as archived campaigns.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11227?
CVE-2025-11227 has a medium severity rating due to information exposure vulnerabilities.
What versions are affected by CVE-2025-11227?
CVE-2025-11227 affects all versions of the GiveWP Donation Plugin up to and including 4.10.0.
How is information exposed in CVE-2025-11227?
CVE-2025-11227 allows unauthorized access to sensitive data through the 'registerGetForm', 'registerGetForms', 'registerGetCampaign', and 'registerGetCampaigns' functions.
How do I fix CVE-2025-11227?
To resolve CVE-2025-11227, update the GiveWP Donation Plugin to the latest version above 4.10.0.
What should I do if I can't update for CVE-2025-11227?
If unable to update, consider disabling the affected functions in the GiveWP Donation Plugin to mitigate risks associated with CVE-2025-11227.