CVE-2025-7221 in GiveWP Plugin
Сводка
по MITRE • 21.08.2025
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the give_update_payment_status() function in all versions up to, and including, 4.5.0. This makes it possible for authenticated attackers, with GiveWP Worker-level access and above, to update donations statuses. This ability is not present in the user interface.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.