The GiveWP WordPress plugin before version 4.16.3 includes a REST API endpoint that returns recurring‑donation records without requiring authentication. This lack of access control allows any unauthenticated user to query the endpoint and receive sensitive information such as donor names and subscription details, violating confidentiality and constituting an information‑disclosure vulnerability of CWE‑200.

Any website running the GiveWP WordPress plugin with a version older than 4.16.3 is vulnerable. The problem is confined to the plugin itself and affects all WordPress installations that provide the default REST API endpoints for the plugin. No specific host or operating system constraints are mentioned, so any supported WordPress site that has the affected plugin version is at risk.

The vulnerability has a CVSS score of 7.5, indicating a high level of severity. The EPSS score is reported as less than 1%, suggesting that exploit activity is currently low but not impossible. The flaw is not listed in CISA’s KEV catalog, meaning there have been no confirmed active exploitation incidents to date. Because the REST endpoint is exposed over HTTP(S) without authentication, a remote attacker can easily retrieve the disclosed data by simply sending GET requests to the endpoint. There are no prerequisite conditions beyond network reachability to the target site.