CVE-2025-7221: GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Missing Authorization to Donation Update
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the giveupdatepaymentstatus() function in all versions up to, and including, 4.5.0. This makes it possible for authenticated attackers, with GiveWP Worker-level access and above, to update donations statuses. This ability is not present in the user interface.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7221?
CVE-2025-7221 is classified as a medium severity vulnerability due to its potential for unauthorized data modifications.
How do I fix CVE-2025-7221?
To fix CVE-2025-7221, you should update the GiveWP plugin to version 4.5.1 or later that addresses the missing capability check.
Who is affected by CVE-2025-7221?
CVE-2025-7221 affects all versions of the GiveWP Donation Plugin for WordPress up to and including 4.5.0.
What type of vulnerability is CVE-2025-7221?
CVE-2025-7221 is an unauthorized modification of data vulnerability due to insufficient capability checks in the plugin.
Can CVE-2025-7221 be exploited remotely?
Yes, CVE-2025-7221 can be exploited remotely as it allows unauthorized users to modify payment statuses.