Description
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to extract donor names, emails, and donor id. CVE-2025-47444 is a duplicate of this issue. CVE-2025-47444 is a duplicate of this issue.
Published: 2025-08-06
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Exposure
Action: Apply Patch
AI Analysis

Impact

The vulnerability allows unauthenticated attackers to read donor names, email addresses and donor identifiers, compromising the confidentiality of personal data. It is classified as an information disclosure weakness (CWE‑200).

Affected Systems

WordPress sites that run the GiveWP – Donation Plugin and Fundraising Platform version 4.6.0 or earlier are impacted. The plugin is distributed by stellarwp and is deployed as a WordPress plugin.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate risk. The EPSS score of <1% suggests a low likelihood of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is unauthenticated access through the web interface or exposed API endpoints, enabling any visitor to retrieve sensitive donor information.

Generated by OpenCVE AI on April 21, 2026 at 03:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update GiveWP to the latest version that is greater than 4.6.0.
  • Disable or limit access to donor‑data endpoints if the plugin provides such a setting.
  • Audit the plugin configuration for any exposed data endpoints and verify the update has removed the disclosure.

Generated by OpenCVE AI on April 21, 2026 at 03:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-23814 The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to extract donor names, emails, and donor id.
History

Wed, 08 Apr 2026 17:45:00 +0000

Type Values Removed Values Added
Description The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to extract donor names, emails, and donor id. The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to extract donor names, emails, and donor id. CVE-2025-47444 is a duplicate of this issue. CVE-2025-47444 is a duplicate of this issue.

Tue, 12 Aug 2025 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Givewp
Givewp givewp
CPEs cpe:2.3:a:givewp:givewp:*:*:*:*:*:wordpress:*:*
Vendors & Products Givewp
Givewp givewp

Thu, 07 Aug 2025 07:15:00 +0000

Type Values Removed Values Added
First Time appeared Givew
Givew donation Plugin And Fundraising Platform
Wordpress
Wordpress wordpress
Vendors & Products Givew
Givew donation Plugin And Fundraising Platform
Wordpress
Wordpress wordpress

Wed, 06 Aug 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 06 Aug 2025 09:30:00 +0000

Type Values Removed Values Added
Description The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to extract donor names, emails, and donor id.
Title GiveWP – Donation Plugin and Fundraising Platform <= 4.6.0 - Unauthenticated Donor Data Exposure
Weaknesses CWE-200
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Givew Donation Plugin And Fundraising Platform
Givewp Givewp
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T16:59:32.063Z

Reserved: 2025-08-05T20:29:49.881Z

Link: CVE-2025-8620

cve-icon Vulnrichment

Updated: 2025-08-06T19:29:52.023Z

cve-icon NVD

Status : Modified

Published: 2025-08-06T10:15:35.967

Modified: 2026-04-08T18:25:21.470

Link: CVE-2025-8620

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-21T03:45:27Z

Weaknesses