The vulnerability arises from a missing capability check in the give_update_payment_status() function, allowing any authenticated user with GiveWP Worker-level access or higher to change the status of a donation. This flaw does not appear in the user interface but can be exploited through the plugin's backend logic. The impact is that attackers can alter donation records to mark funds as collected, refunded, or otherwise modified, undermining financial integrity and potentially defrauding donors or administrators. The flaw is a classic missing authorization check (CWE‑285) and is likely exploited via the plugin’s API or backend interface by an authenticated user with Worker-level or higher capability.

The issue affects the GiveWP – Donation Plugin and Fundraising Platform provided by StellarWP, versions up to and including 4.5.0, deployed on WordPress installations.

With a CVSS score of 4.3 the flaw is of moderate severity, and an EPSS score of less than 1% indicates a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated and possess at least Worker-level capability; exploitation can occur via the plugin's API or back‑end interfaces. No external input is required to trigger the flaw.