CVE-2025-11227 – The GiveWP WordPress plugin has an information ... (How to Fix)

📋 TL;DR

The GiveWP WordPress plugin has an information disclosure vulnerability that allows unauthenticated attackers to access private donation forms and archived campaigns. All WordPress sites using GiveWP versions up to 4.10.0 are affected. This occurs because the plugin's REST API endpoints lack proper authorization checks.

💻 Affected Systems

Products:

GiveWP - Donation Plugin and Fundraising Platform for WordPress

Versions: All versions up to and including 4.10.0

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Affects all WordPress installations with the vulnerable GiveWP plugin versions installed and activated.

📦 What is this software?

Givewp by Givewp

View all CVEs affecting Givewp →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could extract sensitive donor information, campaign strategies, and internal fundraising data from private forms and archived campaigns, potentially leading to data breaches and reputational damage.

🟠

Likely Case

Unauthenticated users accessing private donation form details and archived campaign information, exposing internal fundraising operations and potentially donor data.

🟢

If Mitigated

With proper access controls, only authorized users can access private forms and archived campaigns, limiting exposure to authenticated administrators.

🌐 Internet-Facing: HIGH - The vulnerability affects WordPress plugins exposed to the internet, and exploitation requires no authentication.

🏢 Internal Only: MEDIUM - Internal systems could still be affected if the plugin is used internally, but exposure is limited to internal networks.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation involves simple HTTP requests to vulnerable REST API endpoints without authentication.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 4.10.1 and later

Vendor Advisory: https://wordpress.org/plugins/give/#developers

Restart Required: No

Instructions:

1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find GiveWP and click 'Update Now'
4. Verify version is 4.10.1 or higher

🔧 Temporary Workarounds

Disable vulnerable REST endpoints

all

Add code to functions.php to remove or restrict access to the vulnerable endpoints

add_filter('rest_endpoints', 'disable_givewp_vulnerable_endpoints');
function disable_givewp_vulnerable_endpoints($endpoints) {
    unset($endpoints['/give/v3/forms']);
    unset($endpoints['/give/v3/campaigns']);
    return $endpoints;
}

🧯 If You Can't Patch

Temporarily deactivate the GiveWP plugin until patching is possible
Implement web application firewall rules to block requests to /give/v3/forms and /give/v3/campaigns endpoints

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Installed Plugins for GiveWP version. If version is 4.10.0 or lower, you are vulnerable.

Check Version:

wp plugin list --name=give --field=version (if WP-CLI installed)

Verify Fix Applied:

After updating, verify GiveWP version is 4.10.1 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Multiple GET requests to /wp-json/give/v3/forms or /wp-json/give/v3/campaigns from unauthenticated users
Access to private form data by non-admin users

Network Indicators:

Unusual traffic patterns to GiveWP REST API endpoints
Data extraction patterns from donation forms

SIEM Query:

source="wordpress.log" AND (uri_path="/wp-json/give/v3/forms" OR uri_path="/wp-json/give/v3/campaigns") AND user="-"

📊 Metadata

CVE ID: CVE-2025-11227

CVSS v3 Score: 6.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE: CWE-285

EPSS Score: 0.17% exploit probability (38th percentile)

Published: October 4, 2025

Last Updated: November 26, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-11227, you might also want to check these: