Liquid Web GiveWP Plugin Missing Authorization Vulnerability Allowing Arbitrary Content Deletion

A missing authorization vulnerability has been identified in the Liquid Web / StellarWP GiveWP plugin, specifically in versions through 2.25.1. This vulnerability allows for arbitrary content deletion, meaning that a malicious actor could potentially delete various types of content from a website, such as images, posts, or pages.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of content from affected WordPress sites, allowing attackers to remove posts, pages, or media files.

Remediation

Users of the GiveWP plugin should update to version 2.25.2 or later to address this vulnerability. Patchstack users can enable auto-update for vulnerable plugins.