CVE-2025-11228CWE-862broken-access-control

CVE-2025-11228

Medium · published October 4, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
20.4
In the wild
Unconfirmed
What it is

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `registerAssociateFormsWithCampaign` function in all versions up to, and including, 4.10.0. This makes it possible for unauthenticated attackers to associate any donation forms with any campaign.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00289 · 20.4th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-10-04T07:15Z
Affected products (1)
ProductVersionsFixed in
givewp/givewp< 4.10.14.10.1
References (3)
https://plugins.trac.wordpress.org/browser/give/tags/4.9.0/src/DonationForms/Routes/DonationFormsEntityRoute.php#L131 · [email protected]https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3371948%40give&new=3371948%40give&sfp_email=&sfph_mail= · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/ddf9a043-5eb6-46fd-88c2-0f5a04f73fc9?source=cve · [email protected]
EPSS history
Timeline
  • 04 OCT 02:24Z
    GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms-Campaign Association
    cvelistv5