Technical impact
This vulnerability exists in the GiveWP WordPress plugin version prior to 4.19.0.1. It allows an unauthenticated visitor to access a public front‑end route that renders the contents and configuration of donation forms that are set to draft, pending, private, or scheduled. Because the plugin performs no status or capability checks before rendering the form, an attacker can retrieve details such as form labels, payment settings, and any other configuration data that WordPress core normally protects from public view. The breach exposes potentially sensitive business or financial information, risking confidentiality compromise for the organization that hosts the plugin.
Affected Systems
The affected applications are WordPress sites that utilize the GiveWP plugin in any version older than 4.19.0.1. All users running a compromised site are at risk, regardless of the size of the deployment, because the exploit does not require privileged access and the vulnerability is accessed via a publicly reachable URL.
Risk and Exploitability
With an EPSS score of less than 1% and no evidence of observed exploitation, the likelihood of immediate compromise remains uncertain. The CVSS score of 5.3 indicates a medium severity information disclosure risk, highlighting the potential to expose private form data if the issue is leveraged. The vulnerability is not listed in the CISA KEV catalog, but administrators should not ignore it because the front‑end route is universally reachable and the missing access control permits any internet user to view unpublished donation forms.
