Medium severity4.3NVD Advisory· Published Aug 21, 2025· Updated Jun 17, 2026

CVE-2025-7221

Description

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the give_update_payment_status() function in all versions up to, and including, 4.5.0. This makes it possible for authenticated attackers, with GiveWP Worker-level access and above, to update donations statuses. This ability is not present in the user interface.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Givewpllm-fuzzy2 versions
<=4.5.0+ 1 more
- (no CPE)range: <=4.5.0
- (no CPE)
stellarwp/GiveWP – Donation Plugin and Fundraising Platformv5
Range: 0

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/3333090/givenvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/8766608e-df72-4b9d-a301-a50c64fadc9anvdThird Party Advisory
plugins.trac.wordpress.org/browser/give/trunk/includes/payments/functions.phpnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000