The vulnerability resides in a misconfigured capability check within the permissionsCheck function of the GiveWP Donation Plugin and Fundraising Platform. This flaw (CWE-200, Sensitive Information Exposure) allows authenticated users who have Subscriber-level roles or higher to access API endpoints and retrieve donor reports that include amounts and personal information. The impact is the exposure of confidential data, violating the confidentiality property and potentially leading to privacy breaches for donors.

Affects all versions of the GiveWP plugin for WordPress up to and including 3.22.1, regardless of the WordPress core version. Users who run any vulnerable version of the plugin, whether on public or private sites, are at risk.

The CVSS score of 5.3 reflects moderate severity, while the EPSS score indicates a very low likelihood of exploitation (under 1 percent). The vulnerability requires legitimate credentials, so it is limited to authenticated subscribers or higher-level accounts. The attacker can exploit the flaw by calling the relevant API endpoints to pull sensitive donation data; the absence of a KEV listing further underlines the current low exploitation probability.