CVE-2025-2025

🗓️ 15 Mar 2025 11:13:27Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 91 Views🌐 WEB

GiveWP Donation Plugin is vulnerable to unauthorized data access in versions up to 3.22.0.

Reporter	Title	Published	Views	Family All 14
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in OpenJDK may affect opensearch in IBM Business Automation Workflow on Containers - CVE-2025-30749, CVE-2025-30754, CVE-2025-2025-50059	7 Oct 202517:04	–	ibm
GithubExploit	Exploit for Missing Authorization in Givewp	9 Jan 202620:29	–	githubexploit
Circl	CVE-2025-2025	15 Mar 202511:44	–	circl
CNNVD	WordPress plugin GiveWP has a security vulnerability	15 Mar 202500:00	–	cnnvd
Cvelist	CVE-2025-2025 Give <= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function	15 Mar 202511:13	–	cvelist
EUVD	EUVD-2025-6623	3 Oct 202520:07	–	euvd
NVD	CVE-2025-2025	15 Mar 202512:15	–	nvd
osv_cve	CVE-2025-2025	15 Mar 202512:15	–	osv_cve
Patchstack	WordPress Give plugin <= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function vulnerability	18 Mar 202507:46	–	patchstack
Positive Technologies	PT-2025-11333	15 Mar 202500:00	–	ptsecurity

NVD

Vulners

Node

givewp givewpRange<3.22.1wordpress

[
  {
    "vendor": "stellarwp",
    "product": "GiveWP – Donation Plugin and Fundraising Platform",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.22.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3252319/
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/40595943-121d-4492-a0ed-f2de1bd99fda
plugins	www.plugins.trac.wordpress.org/browser/give/trunk/includes/admin/reports/reports.php
wordpress	www.wordpress.org/plugins/give/

Parameter	Position	Path	Description	CWE
context	request body	/api/upload	Path traversal/file upload vulnerability in FileUploadController allowing arbitrary file placement via crafted multipart/form-data (contextData contains traversal path; filename controls uploaded file).	CWE-862
resumableFilename	request body	/api/upload	Path traversal/file upload vulnerability in FileUploadController allowing arbitrary file placement via crafted multipart/form-data (contextData contains traversal path; filename controls uploaded file).	CWE-862
contextData	request body	/api/upload	Path traversal/file upload vulnerability in FileUploadController allowing arbitrary file placement via crafted multipart/form-data (contextData contains traversal path; filename controls uploaded file).	CWE-862

17 Jun 2026 09:06Current

8.1High risk

Vulners AI Score8.1

CVSS 3.16.5 - 7.5

EPSS0.00631

SSVC

CWE-862