Listen to this Post
The CVE-2025-7221 vulnerability stems from a missing capability check in the `give_update_payment_status()` function within the GiveWP WordPress plugin. This function handles donation status updates but fails to verify if the authenticated user has proper authorization. In WordPress, capability checks are essential for enforcing role-based permissions, and their absence allows unauthorized actions. Attackers with GiveWP Worker-level access or higher—a specific plugin role—can exploit this flaw. By crafting HTTP requests, such as POST requests to WordPress admin AJAX endpoints or similar interfaces, attackers can trigger this function remotely. The request includes parameters like donation ID and desired status (e.g., ‘complete’, ‘pending’). Since no validation occurs, attackers can arbitrarily modify donation records, potentially marking unpaid donations as completed or altering financial tracking. This vulnerability affects all plugin versions up to and including 4.5.0. The function is not exposed in the user interface, implying it should be restricted, but the missing check bypasses this intention. Exploitation requires authenticated access, but the Worker role is lower than administrator, escalating privileges. The core issue is insecure direct object reference and insufficient authorization, common in web applications. Attackers may use tools like curl or browser consoles to send malicious requests. This can lead to data integrity loss, affecting donation reports and fund management. The vulnerability is patched in later versions by adding proper capability checks, such as `current_user_can()` before status updates.
Platform: GiveWP WordPress Plugin
Version: ≤ 4.5.0
Vulnerability: Unauthorized data modification
Severity: Medium
Date: 2025-08-21
Prediction: Patched in 4.5.1
What Undercode Say:
curl -X POST https://victim.site/wp-admin/admin-ajax.php –data “action=give_update_payment_status&donation_id=123&status=complete”
wp plugin list –status=active –field=version –name=give
grep -r “give_update_payment_status” ./wp-content/plugins/give/
how Exploit:
Authenticated attackers send crafted POST requests to vulnerable endpoints with donation ID and status parameters, bypassing capability checks.
Protection from this CVE
Update to GiveWP version above 4.5.0, apply vendor patches, restrict GiveWP Worker role access.
Impact:
Unauthorized donation status changes, financial reporting inaccuracies, data integrity loss.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
