CVE-2025-2025: Give <= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the givereportsearnings() function in all versions up to, and including, 3.22.0. This makes it possible for unauthenticated attackers to disclose sensitive information included within earnings reports.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/givewpto a version that resolves this vulnerability.Fixed in 3.22.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2025?
CVE-2025-2025 is considered a high severity vulnerability due to the potential for unauthorized data access.
How do I fix CVE-2025-2025?
To fix CVE-2025-2025, update the GiveWP – Donation Plugin and Fundraising Platform to version 3.22.1 or later.
Who is affected by CVE-2025-2025?
Users of the GiveWP – Donation Plugin and Fundraising Platform version 3.22.0 and below are affected by CVE-2025-2025.
What type of vulnerability is CVE-2025-2025?
CVE-2025-2025 is an unauthorized access vulnerability resulting from a failure to implement proper capability checks.
Can CVE-2025-2025 be exploited remotely?
Yes, CVE-2025-2025 can be exploited remotely by unauthenticated attackers, making it a critical concern.