CVE-2025-22633: Divi Donation Modules Info Disclosure Flaw

CVE-2025-22633 Overview

CVE-2025-22633 is a sensitive data exposure vulnerability in the StellarWP Give – Divi Donation Modules plugin for WordPress. The flaw allows unauthenticated attackers to retrieve embedded sensitive data from externally-accessible files or directories. The vulnerability affects all versions of the plugin up to and including 2.0.0. It is classified under CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory. The issue is exploitable over the network without user interaction or authentication, though impact is limited to confidentiality of low-sensitivity data.

Critical Impact
Unauthenticated remote attackers can retrieve embedded sensitive data from the affected WordPress plugin, exposing configuration or donor-related information.

Affected Products

StellarWP Give – Divi Donation Modules plugin (give-donation-modules-for-divi)
All plugin versions from initial release through 2.0.0
WordPress sites running the Divi theme with this plugin installed

Discovery Timeline

2025-02-23 - CVE-2025-22633 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22633

Vulnerability Analysis

The vulnerability stems from the plugin placing sensitive information inside files or directories accessible from the public web. Attackers can request these resources directly over HTTP without authentication. The scope is marked as changed, meaning the flaw affects resources beyond the vulnerable component itself. The exploit prediction score indicates a low but non-trivial probability of exploitation activity in the near term. Since the attack requires no privileges or user interaction, automated scanners can easily identify affected installations.

Root Cause

The root cause is improper handling of sensitive data storage within the plugin. Files containing configuration data, credentials, or donation-related metadata are written to locations reachable through direct URL requests. WordPress plugins commonly expose such artifacts under /wp-content/plugins/ paths when the developer does not add index files or .htaccess restrictions. The plugin fails to enforce access controls on these embedded resources.

Attack Vector

An attacker sends crafted HTTP requests to predictable file paths within the plugin directory. No authentication or user interaction is required. The attacker retrieves embedded sensitive data such as API keys, configuration parameters, or donor context. This data can then be used to pivot into other systems or facilitate follow-on attacks against the WordPress site.

See the PatchStack Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-22633

Indicators of Compromise

Unexpected HTTP GET requests to files under /wp-content/plugins/give-donation-modules-for-divi/ from unknown IP addresses
Access log entries showing enumeration of plugin subdirectories or configuration files
Requests returning HTTP 200 responses for files that should not be publicly accessible

Detection Strategies

Review web server access logs for direct requests to plugin file paths outside standard entry points
Monitor for automated scanning patterns targeting the give-donation-modules-for-divi directory
Use WordPress security scanners to enumerate exposed files and identify sensitive artifacts

Monitoring Recommendations

Enable verbose HTTP access logging on the WordPress host and forward logs to a centralized platform
Alert on repeated 200-status responses to non-PHP files under plugin directories
Track outbound network traffic from the WordPress host for signs of data exfiltration following suspicious access

How to Mitigate CVE-2025-22633

Immediate Actions Required

Identify all WordPress sites running the Give – Divi Donation Modules plugin at version 2.0.0 or earlier
Disable or remove the plugin until a patched version is confirmed available
Rotate any credentials, API keys, or secrets that may have been embedded in plugin-managed files

Patch Information

At the time of publication, no fixed version beyond 2.0.0 is documented in the referenced advisory. Administrators should monitor the PatchStack Vulnerability Report and the StellarWP vendor channels for a security release addressing this issue.

Workarounds

Block direct HTTP access to the plugin directory using web server rules or .htaccess deny directives
Deploy a web application firewall rule to reject requests targeting sensitive file extensions within the plugin path
Restrict access to /wp-content/plugins/give-donation-modules-for-divi/ to authenticated administrative sessions only

bash

# Apache .htaccess example to block direct file access in the plugin directory
<Directory "/var/www/html/wp-content/plugins/give-donation-modules-for-divi">
    <FilesMatch "\.(log|json|txt|ini|conf|bak)$">
        Require all denied
    </FilesMatch>
</Directory>