CVE-2025-11228: GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms-Campaign Association
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the registerAssociateFormsWithCampaign function in all versions up to, and including, 4.10.0. This makes it possible for unauthenticated attackers to associate any donation forms with any campaign.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11228?
CVE-2025-11228 has a high severity level due to the potential for unauthorized data modification.
How do I fix CVE-2025-11228?
To fix CVE-2025-11228, update the GiveWP Donation Plugin to a version higher than 4.10.0 where the issue has been resolved.
What are the potential impacts of CVE-2025-11228?
The potential impacts of CVE-2025-11228 include unauthorized access and modification of donation data, which could undermine the integrity of fundraising efforts.
Which versions are affected by CVE-2025-11228?
CVE-2025-11228 affects all versions of the GiveWP Donation Plugin up to and including version 4.10.0.
Is my donation data safe from CVE-2025-11228?
If you are using a vulnerable version of the GiveWP Donation Plugin, your donation data may not be safe and should be protected by updating the plugin.