CVE-2025-7221 Overview
CVE-2025-7221 is a broken access control vulnerability in the GiveWP – Donation Plugin and Fundraising Platform for WordPress. The flaw affects all versions up to and including 4.5.0. The give_update_payment_status() function lacks a capability check, allowing authenticated users with GiveWP Worker-level access or higher to modify donation statuses. The action is not exposed in the plugin's user interface but remains reachable through direct request invocation. This weakness maps to Improper Authorization [CWE-285].
Critical Impact
Authenticated low-privilege users can alter donation payment statuses, corrupting financial records and reporting for fundraising campaigns.
Affected Products
- GiveWP – Donation Plugin and Fundraising Platform for WordPress
- All versions through 4.5.0
- WordPress installations running the affected plugin with GiveWP Worker or higher accounts
Discovery Timeline
- 2025-08-21 - CVE-2025-7221 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2025-7221
Vulnerability Analysis
GiveWP exposes give_update_payment_status() inside includes/payments/functions.php. The function updates the status of a donation record but does not verify that the calling user holds the appropriate capability to perform administrative donation operations. Because GiveWP registers custom roles such as GiveWP Worker with limited permissions, any authenticated user assigned this role or higher can invoke the code path that reaches the function.
An attacker can transition donations between states such as pending, complete, refunded, failed, cancelled, or abandoned. This distorts donation ledgers, campaign totals, and downstream reporting. It can also trigger side effects tied to status change hooks, including donor emails and integrations with accounting or CRM systems.
The issue is limited to integrity of donation status data. It does not disclose confidential information and does not directly impact availability of the site.
Root Cause
The root cause is a missing capability check inside give_update_payment_status(). The function trusts that upstream callers enforce authorization, but the code path is reachable by low-privilege authenticated users who should not be permitted to modify donation records.
Attack Vector
Exploitation requires network access to the WordPress site and an authenticated account with GiveWP Worker-level access or higher. The attacker submits a request that reaches the vulnerable function and supplies a donation identifier and target status. No user interaction from an administrator is required. See the WordPress Plugin Code Review and the Wordfence Vulnerability Report for technical details.
Detection Methods for CVE-2025-7221
Indicators of Compromise
- Unexpected changes to donation status fields in the wp_give_donations and related meta tables
- Donation status transitions initiated by users assigned the GiveWP Worker role
- Outbound donor notifications or receipt emails that do not correspond to real payment events
- Discrepancies between payment gateway records and GiveWP donation status history
Detection Strategies
- Audit WordPress user activity logs for GiveWP Worker accounts performing donation-modifying actions
- Correlate GiveWP donation status change events with authenticated requests to admin-ajax or REST endpoints tied to payment functions
- Compare gateway transaction reports (Stripe, PayPal, etc.) against GiveWP status fields to surface unauthorized transitions
Monitoring Recommendations
- Enable verbose logging on the WordPress site and forward events to a centralized SIEM or data lake for retention and correlation
- Alert on any donation status change performed by non-administrative accounts
- Track creation of new WordPress users assigned the GiveWP Worker role or higher
How to Mitigate CVE-2025-7221
Immediate Actions Required
- Update GiveWP to the version that includes the fix delivered in changeset 3333090
- Review all accounts with the GiveWP Worker role or higher and remove unused or unnecessary users
- Reconcile recent donation status changes against payment gateway records to identify tampering
Patch Information
The vendor addressed the missing capability check in the GiveWP plugin repository. Apply the update referenced in the WordPress Plugin Changeset Update. Sites running versions up to and including 4.5.0 should upgrade to the patched release.
Workarounds
- Restrict assignment of the GiveWP Worker role until the plugin is patched
- Place the WordPress admin surface behind IP allowlisting or an authenticated reverse proxy to reduce exposure
- Use a Web Application Firewall (WAF) rule to block requests targeting donation status update actions from non-administrative users
- Enable multi-factor authentication for all users with GiveWP administrative or worker roles
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
