CVE-2025-2331: GiveWP Information Disclosure Vulnerability

CVE-2025-2331 Overview

CVE-2025-2331 is an information disclosure vulnerability in the GiveWP – Donation Plugin and Fundraising Platform for WordPress. The flaw exists in all versions up to and including 3.22.1. A misconfigured capability check inside the permissionsCheck function allows authenticated users with Subscriber-level access to reach protected report endpoints. Attackers can extract donor records and donation amounts intended only for administrators. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact

Any low-privileged authenticated user on a WordPress site running vulnerable GiveWP versions can retrieve donor personally identifiable information (PII) and financial reporting data through the plugin's Reports REST API.

Affected Products

• GiveWP – Donation Plugin and Fundraising Platform for WordPress, all versions through 3.22.1
• WordPress sites with the give plugin installed and activated
• Sites permitting user registration at Subscriber role or above

Discovery Timeline

• 2025-03-22 - CVE-2025-2331 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2331

Vulnerability Analysis

The GiveWP plugin exposes reporting endpoints under its REST API namespace. These endpoints return aggregated donor data, donation history, and financial reports. The plugin registers its route handlers with a permissionsCheck callback intended to restrict access to donation managers and administrators. The check is misconfigured and returns a truthy value for any authenticated user, including the Subscriber role. Attackers with a valid session or application password can therefore query the Reports API and receive full response payloads. The relevant handlers are defined in src/API/Endpoints/Reports/Endpoint.php.

Root Cause

The root cause is broken access control in the API permission callback. Instead of validating a donation-management capability such as manage_options or a GiveWP-specific capability, the permissionsCheck function evaluates a check that any logged-in user satisfies. This collapses the authorization boundary between low-privileged subscribers and privileged report consumers. Refer to the WordPress Give Reports Endpoint source for the flawed handler registration.

Attack Vector

Exploitation requires network access to the WordPress REST API and an authenticated session at Subscriber level or above. An attacker registers an account on any site that allows self-registration, authenticates against the WordPress REST API, and issues GET requests to the GiveWP Reports endpoints. The server returns donor names, email addresses, and donation totals without further authorization checks. No user interaction from an administrator is required. The Wordfence Vulnerability Analysis documents the affected routes.

Detection Methods for CVE-2025-2331

Indicators of Compromise

• Unexpected authenticated GET requests from Subscriber accounts to REST paths under /wp-json/give-api/v2/reports/
• Bursts of report queries originating from newly created low-privilege user accounts
• Access log entries showing report endpoint calls without matching administrator session activity

Detection Strategies

• Correlate WordPress user roles with REST API request patterns to flag Subscriber-level accounts calling privileged plugin routes
• Alert on GiveWP Reports API responses larger than a baseline size when the requesting user is not an administrator or donation manager
• Review recent user registrations and cross-reference with GiveWP endpoint access in the same session

Monitoring Recommendations

• Enable WordPress REST API request logging and forward logs to a central SIEM for retention and analysis
• Track the give plugin version across all managed WordPress sites and alert on installations at or below 3.22.1
• Monitor for outbound bulk exports of donor data or unusual volume on /wp-json/give-api/ routes

How to Mitigate CVE-2025-2331

Immediate Actions Required

• Update the GiveWP plugin to a version later than 3.22.1 that includes the fix from WordPress Changeset #3258797
• Audit existing WordPress user accounts and remove unused Subscriber, Contributor, and Author accounts
• Review recent access logs for the Reports REST endpoints and identify any unauthorized data pulls

Patch Information

The vendor addressed the vulnerability in the commit tracked as WordPress Changeset #3258797. The fix replaces the permissive permissionsCheck logic with a capability check aligned to donation-management privileges. Site operators should upgrade through the WordPress plugin updater or by replacing the plugin directory with the patched release.

Workarounds

• Disable open user registration on WordPress sites where GiveWP is installed until the plugin is patched
• Restrict access to /wp-json/give-api/ routes at the web server or web application firewall (WAF) layer to administrator IP ranges
• Temporarily deactivate the GiveWP plugin on sites that cannot immediately apply the update

# Configuration example: block Reports API access at the WAF/Nginx layer
location ~* ^/wp-json/give-api/v2/reports/ {
    allow 203.0.113.10;   # admin workstation
    deny all;
    return 403;
}