Unrated severityNVD Advisory· Published Aug 20, 2024· Updated Apr 8, 2026

GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Limited Information Exposure

CVE-2024-5939

Description

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'setup_wizard' function in all versions up to, and including, 3.13.0. This makes it possible for unauthenticated attackers to read the setup wizard administrative pages.

Affected products

Givewp/Givewpllm-fuzzy
Range: <=3.13.0
stellarwp/GiveWP – Donation Plugin and Fundraising Platformv5
Range: 0
WordPress/Givewpwp-canonicalize

Patches

r3120745

https://plugins.svn.wordpress.orgvia osv

commit

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

plugins.trac.wordpress.org/browser/give/tags/3.12.0/src/Onboarding/Wizard/Page.phpmitre
plugins.trac.wordpress.org/changeset/3120745/mitre
www.wordfence.com/threat-intel/vulnerabilities/id/a104f88b-deae-465d-b4c1-9a1fc78e5ee9mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000