CVE-2025-8620 Overview
CVE-2025-8620 is an information exposure vulnerability in the GiveWP – Donation Plugin and Fundraising Platform for WordPress. The flaw affects all versions up to and including 4.6.0. Unauthenticated attackers can extract donor names, email addresses, and donor IDs from vulnerable installations over the network. The issue is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). CVE-2025-47444 is a duplicate of this issue.
Critical Impact
Remote, unauthenticated attackers can harvest donor personally identifiable information (PII) including names, emails, and donor IDs from any WordPress site running GiveWP 4.6.0 or earlier.
Affected Products
- GiveWP – Donation Plugin and Fundraising Platform for WordPress
- All versions up to and including 4.6.0
- WordPress sites using GiveWP for donation processing and fundraising
Discovery Timeline
- 2025-08-06 - CVE-2025-8620 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-8620
Vulnerability Analysis
The vulnerability resides in the GiveWP plugin's handling of donor data endpoints. The plugin fails to enforce proper authorization checks before returning donor records, allowing anonymous HTTP requests to retrieve information that should be restricted to authenticated administrators. The exposed data set includes donor full names, email addresses, and internal donor IDs.
Because the vulnerable endpoint is reachable over the network without any authentication or user interaction, attackers can enumerate donor records at scale using automated tooling. The EPSS score of 0.532% suggests moderate exploitation likelihood in the near term, though no public exploit code has been observed.
The leaked information supports targeted phishing, donor impersonation, and social engineering campaigns against contributors of nonprofit organizations that use GiveWP.
Root Cause
The root cause is missing or insufficient authorization validation on a plugin endpoint that returns donor records. The plugin logic does not verify the requester's capability or session context before serving the response, exposing data that should be gated behind administrator privileges.
Attack Vector
Exploitation requires only network access to the target WordPress site. An unauthenticated attacker sends crafted HTTP requests to the vulnerable GiveWP endpoint and parses the response to extract donor names, emails, and donor IDs. No user interaction or privileges are required.
Refer to the Wordfence Vulnerability Report and the GitHub Issue Report for technical details of the affected code path.
Detection Methods for CVE-2025-8620
Indicators of Compromise
- Unusual bursts of unauthenticated HTTP requests to GiveWP REST or AJAX endpoints associated with donor data
- Requests originating from a single IP or ASN enumerating sequential donor IDs
- Elevated response sizes on GiveWP endpoints indicating bulk data return
- Access log entries containing give or givewp endpoint paths from unauthenticated sessions
Detection Strategies
- Review WordPress access logs for anonymous requests targeting GiveWP endpoints returning JSON containing donor fields
- Deploy web application firewall (WAF) rules that flag high-volume requests to plugin endpoints from a single source
- Correlate outbound requests against GiveWP paths with the installed plugin version to identify pre-patch installations
Monitoring Recommendations
- Enable detailed HTTP logging on the WordPress front-end and forward logs to a centralized SIEM for analysis
- Alert on request patterns that iterate numeric donor IDs or repeatedly query donor-listing endpoints
- Monitor plugin version inventory across managed WordPress sites to prioritize patching of GiveWP installations at or below 4.6.0
How to Mitigate CVE-2025-8620
Immediate Actions Required
- Update GiveWP to a version later than 4.6.0 on all WordPress sites that use the plugin
- Audit donor records and access logs for evidence of bulk retrieval prior to patching
- Notify donors if evidence of data exposure is identified, in line with applicable data protection regulations
- Restrict administrative and REST API endpoints behind WAF rules until the update is applied
Patch Information
GiveWP addressed the issue in a plugin update tracked in the WordPress Plugin Change Log (changeset 3336253). Administrators should upgrade through the WordPress plugin manager or via WP-CLI. Vendor communications are referenced in the LinkedIn Support Update.
Workarounds
- Deploy a WAF rule to block unauthenticated requests to GiveWP donor-related endpoints until the patch is applied
- Temporarily disable the GiveWP plugin on sites that cannot be updated immediately
- Restrict access to /wp-json/ and /wp-admin/admin-ajax.php for anonymous users via server-level ACLs where feasible
- Rotate any donor identifiers or tokens that may have been exposed through the vulnerable endpoint
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
