The plugin exhibits a missing capability check on several REST API endpoints, allowing unauthenticated actors to call functions that would normally be restricted. This flaw enables the disclosure of sensitive data such as private and draft donation forms and archived campaigns, potentially exposing financial information, donor details, and campaign strategies. The weakness aligns with CWE‑285, representing an authorization bypass incident that compromises confidentiality on the affected site.

GiveWP – Donation Plugin and Fundraising Platform for WordPress, any installation of versions 4.10.0 or earlier. The issue arises in the plugin’s REST API implementations within Company’s codebase; no other plugins or core WordPress components are directly implicated.

With a CVSS score of 6.5, the vulnerability presents medium severity. The EPSS score indicates a very low exploitation probability (<1%). It is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. Knowledge of the affected endpoints can be found in the source references, and the missing authorization check provides an attack vector for unauthenticated attackers, requiring no special credentials or elevated privileges.