GiveWP Donation Plugin Missing Authorization Vulnerability in WordPress

A vulnerability exists in the GiveWP Donation Plugin and Fundraising Platform for WordPress, in all versions through 4.5.0. The issue arises from a lack of proper capability checks in the 'give_update_payment_status()' function, allowing authenticated attackers with GiveWP Worker-level access or higher to unauthorizedly modify donation statuses. This functionality is not available through the user interface.

Impact

Exploitation of this vulnerability allows for unauthorized users to change donation statuses, potentially leading to misuse of donation management features.

Remediation

Users are advised to update the GiveWP Donation Plugin to version 4.6.1 or later, where this vulnerability has been patched.