CVE-2025-4571 – The GiveWP WordPress plugin has an authorizatio... (How to Fix)

📋 TL;DR

The GiveWP WordPress plugin has an authorization bypass vulnerability that allows authenticated users with Contributor-level permissions or higher to view and modify sensitive data. Attackers can access fundraising campaigns, donor information, and modify campaign events without proper authorization. This affects all WordPress sites using GiveWP version 4.3.0 or earlier.

💻 Affected Systems

Products:

GiveWP - Donation Plugin and Fundraising Platform for WordPress

Versions: All versions up to and including 4.3.0

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress installation with GiveWP plugin and at least one user with Contributor role or higher.

📦 What is this software?

Givewp by Givewp

View all CVEs affecting Givewp →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Malicious contributors could delete all fundraising campaigns, exfiltrate donor PII data, and disrupt fundraising operations completely.

🟠

Likely Case

Unauthorized viewing of donor data and campaign information, potentially leading to data privacy violations and reputational damage.

🟢

If Mitigated

Limited impact if proper access controls and monitoring are in place, with quick detection of unauthorized activities.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but is straightforward once authenticated. Contributor role is commonly granted to untrusted users.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 4.3.1 or later

Vendor Advisory: https://wordpress.org/plugins/give/

Restart Required: No

Instructions:

1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find GiveWP plugin
4. Click 'Update Now' if available
5. If not available, download version 4.3.1+ from WordPress.org and manually update

🔧 Temporary Workarounds

Temporary Role Restriction

all

Temporarily remove Contributor and Author roles from untrusted users until patching is complete.

Plugin Deactivation

all

Temporarily deactivate GiveWP plugin if fundraising operations can be paused.

🧯 If You Can't Patch

Implement strict user role management and audit all users with Contributor or higher permissions
Enable detailed logging of all GiveWP plugin activities and set up alerts for suspicious actions

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Installed Plugins → GiveWP version. If version is 4.3.0 or lower, you are vulnerable.

Check Version:

wp plugin list --name=give --field=version

Verify Fix Applied:

After updating, verify GiveWP version shows 4.3.1 or higher in WordPress admin plugins page.

📡 Detection & Monitoring

Log Indicators:

Unauthorized API calls to GiveWP endpoints by Contributor users
Unexpected campaign deletions or modifications
Access to donor data by non-admin users

Network Indicators:

Unusual API requests to /wp-json/give/ endpoints from non-admin users

SIEM Query:

source="wordpress.log" AND ("give/v2" OR "givewp") AND user_role="contributor" AND (action="delete" OR action="view" OR action="modify")

📊 Metadata

CVE ID: CVE-2025-4571

CVSS v3 Score: 5.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE: CWE-862

EPSS Score: 0.07% exploit probability (21.3th percentile)

Published: June 19, 2025

Last Updated: July 10, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-4571, you might also want to check these: