CVE-2025-7221
📋 TL;DR
This vulnerability allows authenticated WordPress users with GiveWP Worker-level access or higher to modify donation payment statuses without proper authorization. The missing capability check in the give_update_payment_status() function enables unauthorized data manipulation. This affects all WordPress sites using GiveWP plugin versions up to and including 4.5.0.
💻 Affected Systems
- GiveWP - Donation Plugin and Fundraising Platform for WordPress
📦 What is this software?
Givewp by Givewp
⚠️ Risk & Real-World Impact
Worst Case
Attackers could mark fraudulent donations as completed, trigger automated fulfillment processes, manipulate financial reporting, or disrupt donation tracking and accounting systems.
Likely Case
Malicious users with legitimate access could alter donation statuses to hide fraudulent activities, manipulate fundraising metrics, or cause administrative confusion.
If Mitigated
With proper user access controls and monitoring, impact is limited to minor data integrity issues that can be audited and corrected.
🎯 Exploit Status
Exploitation requires authenticated access with GiveWP Worker role or higher. Attackers need to understand WordPress plugin structure and API endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 4.5.1 and later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3333090/give
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find GiveWP plugin. 4. Click 'Update Now' if available. 5. Alternatively, download version 4.5.1+ from WordPress.org and manually update.
🔧 Temporary Workarounds
Temporary Capability Restriction
WordPressRemove give_update_payment capability from GiveWP Worker role users until patch can be applied
// Add to theme's functions.php or custom plugin:
add_action('init', 'restrict_give_capabilities');
function restrict_give_capabilities() {
$role = get_role('give_worker');
if ($role) {
$role->remove_cap('give_update_payment');
}
}
🧯 If You Can't Patch
- Implement strict user access controls and limit GiveWP Worker roles to trusted personnel only
- Enable detailed logging of all donation status changes and implement regular audit reviews
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins → GiveWP version. If version is 4.5.0 or lower, system is vulnerable.Check Version:
wp plugin list --name=give --field=versionVerify Fix Applied:
Verify GiveWP plugin version is 4.5.1 or higher in WordPress admin panel. Test donation status update functionality with non-admin users.📡 Detection & Monitoring
Log Indicators:
- Unusual donation status changes from non-admin users
- Multiple donation status updates in short timeframes
- Status changes occurring outside normal business hours
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php with action=give_update_payment_status from non-admin IPs
- Unusual API calls to payment status endpoints
SIEM Query:
source="wordpress.log" AND ("give_update_payment_status" OR "donation status changed") AND user_role!="administrator"