Medium severity6.5NVD Advisory· Published Mar 15, 2025· Updated Jun 17, 2026

CVE-2025-2025

Description

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the give_reports_earnings() function in all versions up to, and including, 3.22.0. This makes it possible for unauthenticated attackers to disclose sensitive information included within earnings reports.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Givewp/Givewp
cpe:2.3:a:givewp:givewp:*:*:*:*:*:wordpress:*:*
Range: <3.22.1
WordPress/Givewpllm-fuzzy2 versions
<=3.22.0+ 1 more
- (no CPE)range: <=3.22.0
- (no CPE)
Package: https://wordpress.org/plugins/givewp
stellarwp/GiveWP – Donation Plugin and Fundraising Platformv5
Range: 0

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/3252319/nvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/40595943-121d-4492-a0ed-f2de1bd99fdanvdThird Party Advisory
plugins.trac.wordpress.org/browser/give/trunk/includes/admin/reports/reports.phpnvdProduct
wordpress.org/plugins/give/nvdProduct

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000