CVE-2024-5940

MEDIUM

GiveWP - Donation Plugin and Fundraising Platform <= 3.13.0 - Unauthenticated Data Modification via Events Beta Feature

Title source: llm
STIX 2.1

Description

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'handle_request' function in all versions up to, and including, 3.13.0. This makes it possible for unauthenticated attackers to edit event ticket settings if the Events beta feature is enabled.

References (4)

Core 4

Scores

CVSS v3 6.5
EPSS 0.0047
EPSS Percentile 37.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (2)
givewp/givewp < 3.14.0
stellarwp/GiveWP – Donation Plugin and Fundraising Platform < 3.13.0
Published Aug 20, 2024
Tracked Since Feb 18, 2026