Pi-hole, a popular network-level ad-blocker, has disclosed that donor names and email addresses were exposed through a security vulnerability in the GiveWP WordPress donation plugin. Pi-hole acts as a DNS sinkhole, filtering out unwanted content before it reaches the users' devices. While initially designed to run on Raspberry Pi single-board computers, it now supports various Linux systems on dedicated hardware or virtual machines. The organization stated that they first learned of the incident on Monday, July 28, after donors began reporting that they were receiving suspicious emails at addresses used exclusively for donations. As explained in a Friday post-mortem, the breach affected users who donated through the Pi-hole website's donation form to support development, exposing personal information that was visible to anyone who viewed the webpage's source code due to a GiveWP security flaw. The vulnerability stemmed from GiveWP, a WordPress plugin used to process donations on the Pi-hole website. The plugin inadvertently made donor information publicly accessible without requiring authentication or special access privileges. While Pi-hole didn't disclose the number of affected customers, the 'Have I Been Pwned' data breach notification service added the Pi-hole breach, saying that it impacted almost 30,000 donors, with 73% of the exposed records already in its database.
Pi-hole added that no donor financial data was compromised, as credit card information and other payme...