A flaw in the GiveWP donation and fundraising plugin allows authenticated WordPress users with Contributor-level permissions or higher to view and delete campaign data, inspect donor information, and alter campaign events. The vulnerability stems from an insufficient capability check in the permissionsCheck functions, giving attackers the same level of access as administrators over certain API endpoints and admin listings. This leads to potential exposure of sensitive donor data, loss of campaign visibility, and interference with fundraising operations.

All WordPress installations that have the GiveWP plugin version 4.3.0 or earlier deployed are affected. The flaw is present in every version up to and including 4.3.0 of the GiveWP – Donation Plugin and Fundraising Platform, affecting sites that rely on this plugin to run donation campaigns.

The CVSS score of 5.4 indicates a medium severity vulnerability, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The plugin is not listed in the CISA KEV catalog, which reduces immediate known threat urgency. Attackers must be authenticated as a Contributor or higher within the WordPress system; the likely attack vector involves using the plugin’s REST API endpoints or the admin UI to view or delete campaigns, donors, or event details. An attacker with these credentials can exploit the missing check to read or modify data that should be restricted to higher‑privilege roles.