CVE-2025-11227: GiveWP Information Disclosure Flaw

CVE-2025-11227 Overview

CVE-2025-11227 affects the GiveWP – Donation Plugin and Fundraising Platform for WordPress in all versions up to and including 4.10.0. The vulnerability exists in the registerGetForm, registerGetForms, registerGetCampaign, and registerGetCampaigns REST API functions. These endpoints lack proper capability checks, allowing unauthenticated attackers to enumerate and extract data from private and draft donation forms as well as archived campaigns. The flaw is categorized under [CWE-285] Improper Authorization and stems from missing access control on REST API routes exposed by the plugin.

Critical Impact
Unauthenticated remote attackers can retrieve sensitive donation form and campaign data that should be restricted to privileged users, exposing non-public fundraising content.

Affected Products

GiveWP – Donation Plugin and Fundraising Platform for WordPress (versions up to and including 4.10.0)
WordPress sites using GiveWP REST API v3 Campaign routes
WordPress sites using GiveWP Donation Forms entity routes

Discovery Timeline

2025-10-04 - CVE-2025-11227 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11227

Vulnerability Analysis

The vulnerability resides in four REST API handlers registered by GiveWP: registerGetForm, registerGetForms, registerGetCampaign, and registerGetCampaigns. These endpoints are defined in RegisterCampaignRoutes.php and DonationFormsEntityRoute.php within the plugin source tree. The route registrations omit a permission_callback that enforces an authenticated capability check, meaning requests are accepted from anonymous clients.

Because the endpoints return form and campaign objects directly from the underlying data store, an unauthenticated caller receives records regardless of their status value. Draft forms, private forms, and archived campaigns are enumerated alongside published entries. Attackers can iterate identifiers or query listing endpoints to inventory the entire content set, including entries the site owner never intended to publish.

Root Cause

The root cause is a missing authorization check [CWE-285] on plugin-registered WordPress REST routes. The route callbacks retrieve records without filtering by post status or checking whether the current user holds a capability such as edit_give_forms. Combined with the absence of a restrictive permission_callback, this converts internal administrative data into publicly retrievable JSON.

Attack Vector

Exploitation requires only network access to the WordPress REST API surface. An attacker sends unauthenticated HTTP GET requests to the affected /wp-json/give-api/v3/ routes for campaigns and donation forms. The server returns records for private, draft, and archived items in the response body. No user interaction, credentials, or preconditions are required beyond the plugin being installed and active.

Technical references for the vulnerable code paths are available from Wordfence and the WordPress plugin repository: WordPress API Route Code (line 60), WordPress API Route Code (line 91), WordPress Donation Form Code (line 52), and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2025-11227

Indicators of Compromise

Unauthenticated HTTP GET requests to /wp-json/give-api/v3/campaigns or /wp-json/give-api/v3/forms from unfamiliar IP addresses
Sequential enumeration patterns targeting campaign or form IDs via the GiveWP REST endpoints
Web server access logs showing responses containing draft or archived form metadata to anonymous clients
Elevated request rates against registerGetForm, registerGetForms, registerGetCampaign, or registerGetCampaigns handlers

Detection Strategies

Review WordPress and web server access logs for requests to GiveWP REST routes lacking authentication cookies or nonces
Correlate REST API responses that include non-published status fields with the requesting client identity
Deploy web application firewall rules that flag anonymous access to give-api/v3 endpoints returning private records
Monitor for scripted enumeration behavior against numeric campaign or form identifiers

Monitoring Recommendations

Enable verbose logging on the WordPress REST API layer to capture endpoint, authentication state, and response size
Baseline normal traffic to GiveWP REST endpoints and alert on deviations in request volume or client diversity
Track outbound response payload sizes on affected routes to identify bulk data extraction
Integrate WordPress logs into a central SIEM to correlate plugin API activity with other suspicious signals

How to Mitigate CVE-2025-11227

Immediate Actions Required

Update the GiveWP plugin to a version later than 4.10.0 that includes the capability check fix
Audit WordPress access logs for prior unauthenticated requests to the affected REST endpoints
Review private, draft, and archived forms and campaigns for any sensitive data that may have been exposed
Restrict access to the WordPress REST API from unnecessary networks via web server or WAF rules

Patch Information

The vendor released a fix through the WordPress plugin repository. Details of the code change are available in the WordPress Changeset Update. Site administrators should upgrade GiveWP to the patched release published after version 4.10.0.

Workarounds

Temporarily deactivate the GiveWP plugin if immediate patching is not possible
Block unauthenticated requests to /wp-json/give-api/v3/ routes at the reverse proxy or WAF layer
Restrict REST API access using a plugin or filter that requires authentication for all requests
Remove draft and archived records containing sensitive information until the update is applied

bash

# Example WAF rule concept (nginx) to block unauthenticated GiveWP REST access
location ~ ^/wp-json/give-api/v3/ {
    if ($http_cookie !~* "wordpress_logged_in") {
        return 403;
    }
}