Executive brief
GiveWP, a popular WordPress plugin used for managing donations, contains a security flaw that exposes donor information. An unauthorized person could access details about recurring donors, including their names and subscription amounts, even if those donors chose to remain anonymous. This could lead to privacy breaches and reputational damage for organizations using the plugin to collect funds.
Technical details
The GiveWP plugin for WordPress fails to implement proper authorization checks on its REST API endpoint for subscription records. Specifically, the endpoint `/wp-json/givewp/v3/subscriptions/` allows unauthenticated remote attackers to retrieve sensitive data by providing a subscription ID. Because these IDs are sequential, an attacker can use simple enumeration (ID walking) to scrape the entire database of recurring donors. The exposed data includes donor names, recurring amounts, subscription status, and renewal dates, bypassing privacy settings intended to keep donors anonymous. This issue is resolved in version 4.16.3.
Affected products
- GiveWP GiveWP before 4.16.3
Timeline
- 2026-07-13: disclosed: Publicly published by WPScan
- 2026-07-31: advisory: NVD publication date
- 2026-07-13: patched: Fix released in version 4.16.3