This vulnerability is a missing authorization flaw that allows attackers to access privileged functionality within the GiveWP WordPress plugin. Because access control security levels are incorrectly configured, users who should not have certain rights can exploit the plugin to perform actions beyond their intended permissions. The potential impact includes unauthorized manipulation of donation settings, viewing or changing donor information, and possibly affecting other sensitive data handled by the plugin.

The vulnerability affects the GiveWP plugin developed by Liquid Web / StellarWP. All installations of the plugin from the earliest available release up through 4.18.0 are impacted. Users should check their current plugin version and consider upgrading if they are running an affected release.

The CVSS score of 5.3 indicates a medium severity risk, and the EPSS score is not available. This issue is not listed in the CISA KEV catalog. Based on the description, the most likely attack vector is a remote web-based attack where an unauthenticated or low-privileged user could exploit the plugin through the public WordPress interface. Given the missing authorization check, the exploit does not require additional authentication steps, making it feasible for attackers with basic access to the website to take advantage of the flaw.