CVE-2025-2025: GiveWP Information Disclosure Vulnerability

CVE-2025-2025 Overview

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress contains an authorization bypass vulnerability due to a missing capability check on the give_reports_earnings() function. This security flaw affects all versions up to and including 3.22.0, allowing unauthenticated attackers to access sensitive earnings report data without proper authorization.

Critical Impact

Unauthenticated attackers can disclose sensitive financial information contained within donation earnings reports, potentially exposing donor data and organizational financial details.

Affected Products

• GiveWP – Donation Plugin and Fundraising Platform versions up to and including 3.22.0
• WordPress installations running vulnerable GiveWP plugin versions

Discovery Timeline

• 2025-03-15 - CVE-2025-2025 published to NVD
• 2025-03-25 - Last updated in NVD database

Technical Details for CVE-2025-2025

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization), a critical security flaw where the application fails to perform an authorization check when an actor attempts to access a resource or perform an action. In the context of GiveWP, the give_reports_earnings() function processes requests for earnings report data without verifying that the requesting user has appropriate administrative privileges.

The vulnerability is network-accessible and requires no authentication or user interaction to exploit. An attacker can directly query the vulnerable endpoint to retrieve sensitive donation and earnings information. The impact is limited to confidentiality, as the vulnerability only allows data disclosure rather than modification or deletion of records.

Root Cause

The root cause stems from a missing capability check in the give_reports_earnings() function located in the plugin's reporting module. WordPress plugins typically use capability checks (such as current_user_can()) to verify that users have appropriate permissions before accessing administrative functions. The absence of this verification allows any visitor, including unauthenticated users, to invoke the function and retrieve protected earnings data.

The vulnerable code can be reviewed at the WordPress Plugin Report Code reference.

Attack Vector

The attack is straightforward and can be executed remotely over the network. An attacker simply needs to identify a WordPress site running a vulnerable version of GiveWP and craft a request to the unprotected earnings report endpoint. Since no authentication is required, the attacker can retrieve earnings reports containing sensitive financial information about donations received by the organization.

The exploitation requires:

1. Identification of a target WordPress site with GiveWP installed
2. Verification that the plugin version is 3.22.0 or earlier
3. Direct request to the vulnerable give_reports_earnings() function endpoint
4. Exfiltration of the returned earnings report data

Detection Methods for CVE-2025-2025

Indicators of Compromise

• Unusual or unauthorized access to earnings report endpoints from external IP addresses
• Unexpected API requests to GiveWP reporting functions from unauthenticated sessions
• Anomalous spikes in traffic to WordPress admin AJAX endpoints related to reporting
• Log entries showing access to earnings reports without corresponding admin authentication

Detection Strategies

• Monitor web server access logs for requests to GiveWP report endpoints from non-admin users
• Implement Web Application Firewall (WAF) rules to detect and block unauthorized report access attempts
• Configure WordPress security plugins to alert on unusual plugin endpoint access patterns
• Review access logs for patterns indicating automated scanning or data harvesting attempts

Monitoring Recommendations

• Enable detailed logging for WordPress AJAX requests, particularly those targeting GiveWP endpoints
• Set up alerts for failed authentication attempts followed by direct endpoint access
• Monitor for bulk data retrieval patterns that may indicate earnings report exfiltration
• Implement real-time monitoring of sensitive administrative endpoints

How to Mitigate CVE-2025-2025

Immediate Actions Required

• Update GiveWP plugin to the latest patched version immediately
• Review access logs for any signs of exploitation or unauthorized data access
• Audit WordPress user accounts and permissions for unauthorized changes
• Consider temporarily disabling the GiveWP plugin if immediate patching is not possible

Patch Information

The vulnerability has been addressed by the GiveWP development team. The security patch adds proper capability checks to the give_reports_earnings() function to ensure only authorized users can access earnings report data. The fix can be reviewed at the WordPress Changeset #3252319.

Organizations should update their GiveWP installation to the latest available version through the WordPress plugin update mechanism or by downloading the patched version from the official WordPress plugin repository.

Workarounds

• Implement WAF rules to block unauthorized access to GiveWP reporting endpoints
• Restrict access to WordPress admin AJAX endpoints at the web server level
• Use WordPress security plugins to add additional authorization layers to sensitive endpoints
• Consider IP whitelisting for administrative functions if updating is delayed

# Example .htaccess rule to restrict access to admin-ajax.php
# Add to WordPress root .htaccess file
<Files admin-ajax.php>
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
    # Add your trusted IP ranges
</Files>