GiveWP Donation Plugin Missing Authorization Vulnerability Allowing Data Manipulation and View

A vulnerability exists in the GiveWP Donation Plugin and Fundraising Platform for WordPress, in all versions through 4.3.0. The issue stems from an inadequate capability check in the permissionsCheck functions, which allows authenticated attackers with Contributor-level access or higher to unauthorizedly view, modify, or delete campaign data. This includes accessing donor information and altering event details related to campaigns.

Impact

Exploitation of this vulnerability could lead to unauthorized access and modification of campaign data, including deletion of campaigns and access to donor information.

Remediation

Users can update to GiveWP version 4.3.1 or later to address this vulnerability.