This vulnerability is an Insecure Direct Object Reference in the GiveWP donation plugin for WordPress. The flaw, identified as CWE–639, allows attackers to alter object identifiers in HTTP requests, enabling unauthorized reading or modification of donation records. Because the application does not verify ownership or permissions on these identifiers, the impact can include the disclosure of sensitive donor information and the potential to tamper with donation transactions, affecting both confidentiality and integrity.

WordPress installations that use the Nexcess GiveWP plugin version 4.16.9 or earlier are vulnerable. Any site running one of these vulnerable plugin releases exposes its donation data store to unauthenticated direct manipulation of record identifiers.

The CVSS score of 5.3 classifies the flaw as medium severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating limited publicly known exploitation.ers can trigger the vulnerability through normal HTTP requests to the plugin’s endpoints without requiring authentication, making remote exploitation straightforward on exposed WordPress sites.