CVE-2025-4571: GiveWP WordPress Plugin Auth Bypass Flaw

CVE-2025-4571 Overview

CVE-2025-4571 is a broken access control vulnerability in the GiveWP – Donation Plugin and Fundraising Platform for WordPress. The flaw affects all versions up to and including 4.3.0. Multiple REST API endpoints implement permissionsCheck functions with insufficient capability validation. Authenticated users with Contributor-level access or higher can view or delete fundraising campaigns, access donor data, and modify campaign events. The issue is tracked under [CWE-862] Missing Authorization and was disclosed through the Wordfence Vulnerability Report.

Critical Impact

Low-privileged authenticated users can access personally identifiable donor information and tamper with active fundraising campaigns, exposing site operators to data privacy violations and financial disruption.

Affected Products

• GiveWP – Donation Plugin and Fundraising Platform for WordPress (all versions ≤ 4.3.0)
• Sites running the plugin with any user role at Contributor level or above
• WordPress deployments exposing the plugin's REST API endpoints to authenticated users

Discovery Timeline

• 2025-06-19 - CVE-2025-4571 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4571

Vulnerability Analysis

The vulnerability resides in the REST API layer of the GiveWP plugin. Several endpoints register permissionsCheck callbacks that fail to enforce administrative capability requirements. Instead of validating capabilities such as manage_options or a dedicated GiveWP capability, the checks accept any authenticated user meeting a minimum threshold. This allows Contributor-level accounts, which are typically granted for content submission, to invoke privileged data operations.

Affected routes include the Logs endpoint at src/API/Endpoints/Logs/Endpoint.php, the campaign management routes in src/Campaigns/ListTable/Routes/, the donor listing endpoint at src/Donors/Endpoints/ListDonors.php, and the event update route at src/EventTickets/Routes/UpdateEvent.php. Each of these routes exposes sensitive functionality including donor data retrieval, campaign deletion, and event modification.

The attack surface spans read and write operations. Attackers can enumerate donors and their donation history, delete fundraising campaigns, and alter ticketed event configuration.

Root Cause

The root cause is missing authorization at the REST API permission callback layer. The permissionsCheck functions across multiple endpoints validate authentication but omit role-appropriate capability verification. WordPress role separation depends on capability checks such as current_user_can( 'manage_give_settings' ), which were absent or overly permissive in the affected files.

Attack Vector

Exploitation requires an authenticated session with Contributor privileges or higher. On WordPress sites that permit self-registration at Contributor level, or on multi-author sites where low-privileged accounts exist, an attacker uses standard REST API requests over HTTPS to invoke the affected endpoints. No user interaction from an administrator is required. The attacker sends authenticated HTTP requests to endpoints such as /wp-json/give-api/v2/donors or the campaign delete route, bypassing the intended administrative boundary.

See the WordPress Give List Donors Endpoint and WordPress Give Delete Campaign Route for the pre-patch source references.

Detection Methods for CVE-2025-4571

Indicators of Compromise

• REST API requests to /wp-json/give-api/* routes originating from user accounts below the Administrator or Shop Manager roles
• Unexpected deletions of GiveWP campaign records in the WordPress database (wp_give_campaigns table)
• Access to donor listing endpoints from Contributor or Author accounts in WordPress access logs
• Modifications to GiveWP event ticket entries not attributable to administrative users

Detection Strategies

• Review web server logs for HTTP requests to GiveWP REST endpoints correlated with non-administrative session cookies or nonces
• Enable WordPress audit logging to capture role, user ID, and action for every REST API call to GiveWP routes
• Compare campaign and donor record counts against known baselines to identify unauthorized deletions or exfiltration

Monitoring Recommendations

• Alert on any HTTP 200 response to /wp-json/give-api/ endpoints where the authenticated user role is Contributor, Author, or Editor
• Monitor outbound data volume from WordPress hosts for anomalous donor data exports
• Track new user registrations at Contributor level and above, particularly on donation-enabled sites

How to Mitigate CVE-2025-4571

Immediate Actions Required

• Update the GiveWP plugin to the version released in WordPress Changeset #3305112, which corrects the permissionsCheck functions
• Audit all WordPress user accounts with Contributor role or higher and remove untrusted accounts
• Review GiveWP campaign, donor, and event records for unauthorized changes and restore from backup if tampering is detected

Patch Information

The vendor addressed the flaw in the changeset published at WordPress Changeset #3305112. The fix adds proper capability checks to the affected REST API permission callbacks. Site administrators should upgrade to the version containing this changeset, which supersedes GiveWP 4.3.0.

Workarounds

• Disable the GiveWP plugin until the patched version is deployed if upgrade is not immediately possible
• Restrict access to /wp-json/give-api/ routes at the web server or WAF layer to authenticated administrator IP ranges
• Temporarily remove Contributor and Author accounts, or downgrade them to Subscriber, on sites where donation processing is active

# Example WAF rule to restrict GiveWP REST endpoints to admin IPs
location ~ ^/wp-json/give-api/ {
    allow 203.0.113.10;   # trusted admin IP
    deny all;
}