Unrated severityNVD Advisory· Published Mar 15, 2025· Updated Apr 8, 2026

Give <= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function

CVE-2025-2025

Description

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the give_reports_earnings() function in all versions up to, and including, 3.22.0. This makes it possible for unauthenticated attackers to disclose sensitive information included within earnings reports.

Affected products

Givewp/Givewpllm-fuzzy
Range: <=3.22.0
stellarwp/GiveWP – Donation Plugin and Fundraising Platformv5
Range: 0
WordPress/Givewpwp-canonicalize

Patches

r3252319

https://plugins.svn.wordpress.orgvia osv

commit

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

plugins.trac.wordpress.org/browser/give/trunk/includes/admin/reports/reports.phpmitre
plugins.trac.wordpress.org/changeset/3252319/mitre
wordpress.org/plugins/give/mitre
www.wordfence.com/threat-intel/vulnerabilities/id/40595943-121d-4492-a0ed-f2de1bd99fdamitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000