CVE-2025-11228: GiveWP Auth Bypass Vulnerability

CVE-2025-11228 Overview

CVE-2025-11228 affects the GiveWP – Donation Plugin and Fundraising Platform for WordPress. The vulnerability stems from a missing capability check on the registerAssociateFormsWithCampaign function in all versions up to and including 4.10.0. Unauthenticated attackers can associate arbitrary donation forms with any campaign on the target site. The issue is classified as Missing Authorization [CWE-862] and impacts data integrity without directly exposing sensitive data or affecting availability.

Critical Impact
Unauthenticated attackers can modify donation form and campaign relationships on affected GiveWP installations, disrupting fundraising workflows and reporting integrity.

Affected Products

GiveWP – Donation Plugin and Fundraising Platform for WordPress
All versions up to and including 4.10.0
WordPress sites running the vulnerable give plugin

Discovery Timeline

2025-10-04 - CVE-2025-11228 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11228

Vulnerability Analysis

The flaw resides in the GiveWP REST route handler responsible for associating donation forms with campaigns. The registerAssociateFormsWithCampaign function, defined in src/DonationForms/Routes/DonationFormsEntityRoute.php, fails to verify that the requester has the required WordPress capability before performing the association. As a result, any network-based caller can invoke the endpoint without authentication and rewrite the form-to-campaign mapping.

Because the endpoint changes plugin state rather than exposing secrets, the impact is limited to integrity. Attackers can reassign donation forms to attacker-chosen campaigns, redirect donor-facing content, or corrupt fundraising reports. The vulnerability does not expose donation data directly and does not crash the site.

Root Cause

The REST route registers a permission callback that does not enforce a capability check appropriate for a state-changing operation. The handler proceeds to update the persistent relationship between donation forms and campaigns regardless of the caller's identity or role. This is a textbook Missing Authorization defect [CWE-862] in a WordPress REST endpoint.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker sends an HTTP request to the GiveWP REST endpoint that invokes registerAssociateFormsWithCampaign with attacker-chosen form and campaign identifiers. No credentials, tokens, or user interaction are needed. See the WordPress Plugin Source Code and the Wordfence Vulnerability Report for handler details.

Detection Methods for CVE-2025-11228

Indicators of Compromise

Unexpected changes to donation form and campaign associations inside the GiveWP admin dashboard.
HTTP requests to GiveWP REST routes referencing associate or campaign from unauthenticated sessions.
Audit log gaps around form-campaign updates with no corresponding administrator login.

Detection Strategies

Enable WordPress REST API access logging and alert on unauthenticated POST or PUT requests to /wp-json/give-api/* endpoints.
Compare current form-campaign associations to a known-good baseline exported from the GiveWP database tables.
Deploy a Web Application Firewall rule that requires an authenticated session cookie for GiveWP campaign association routes.

Monitoring Recommendations

Forward WordPress and web server logs to a centralized analytics platform and monitor for anomalous access patterns to plugin REST routes.
Track plugin version inventory across sites to identify GiveWP installations at or below 4.10.0.
Alert on modifications to the give_campaigns and related donation form tables outside administrator activity windows.

How to Mitigate CVE-2025-11228

Immediate Actions Required

Update GiveWP to a version above 4.10.0 that adds a capability check to the associate-forms route.
Audit existing donation form and campaign associations for unauthorized changes since October 2025.
Restrict access to the WordPress REST API from untrusted networks where feasible.

Patch Information

The vendor addressed the missing capability check through the plugin repository. Refer to the WordPress ChangeSet History for the code change that introduces authorization on the registerAssociateFormsWithCampaign route. Site operators should upgrade the give plugin to the latest release through the WordPress admin console or WP-CLI.

Workarounds

Block unauthenticated access to /wp-json/give-api/ endpoints at the WAF or reverse proxy layer until the patch is applied.
Temporarily disable the GiveWP plugin on production sites that cannot be updated immediately.
Restrict WordPress REST API access to authenticated users by enforcing a permission callback at the site level.

bash

# Update the GiveWP plugin using WP-CLI
wp plugin update give --version=latest
wp plugin list --name=give --fields=name,status,version