GiveWP Donation Plugin and Fundraising Platform Missing Authorization Vulnerability in Forms-Campaign Association

A vulnerability exists in the GiveWP Donation Plugin and Fundraising Platform for WordPress, in all versions through 4.10.0. The issue arises from a lack of proper capability checks in the 'registerAssociateFormsWithCampaign' function, allowing unauthenticated attackers to associate any donation forms with any campaign. This unauthorized modification of data could lead to misuse of the donation forms and campaigns on the affected WordPress site.

Impact

Exploitation of this vulnerability allows for unauthorized association of donation forms with campaigns, potentially leading to misuse of fundraising efforts or misrepresentation of donation activities.

Remediation

Users can update to GiveWP version 4.10.1 or later, where this vulnerability has been patched.