CVE-2025-22633

Executive Summary

CVE-2025-22633 is a vulnerability in the WordPress plugin Give – Divi Donation Modules (developed by StellarWP). The flaw allows an unauthenticated attacker to retrieve embedded sensitive data from externally accessible files or directories. This is a classic case of CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory, where the plugin fails to restrict access to files that may contain credentials, API keys, or other secrets. The CVSS score of 5.8 (Medium) reflects the low complexity and network-based attack vector, but the impact is limited to confidentiality. No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users who installed the plugin from the WordPress dashboard or via Composer/WP-CLI are at risk. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is part of the WordPress ecosystem. Administrators should verify the integrity of their plugin files and monitor for unauthorized modifications.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.8 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No victim action required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: Low (C:L) – Limited sensitive data exposure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The lack of a public exploit and low EPSS score (0.0%) reduces immediate risk, but the vulnerability is trivial to exploit once discovered. Attackers could harvest API keys, database credentials, or donation transaction details.

Deep Dive & Mechanics

The vulnerability resides in the Give – Divi Donation Modules plugin, which integrates the GiveWP donation system with the Divi theme builder. The plugin likely stores sensitive configuration data (e.g., API keys, Stripe secrets, or database credentials) in a file or directory that is accessible via the web root without proper access controls.

Root Cause: The plugin creates a file (e.g., debug.log, config.json, or a backup file) in the WordPress uploads directory or plugin folder that is readable by anyone who knows the path. This file contains embedded sensitive data such as:

• Stripe or PayPal API keys
• Database connection strings
• Encryption salts
• Donor PII (partial)

Attack Vector: An attacker can directly request the file via HTTP GET, e.g.:

https://target.com/wp-content/plugins/give-donation-modules-for-divi/debug.log

or

https://target.com/wp-content/uploads/give-donation-modules/config.json

Impact: Successful exploitation leads to disclosure of sensitive data, which can be used for further attacks (e.g., credential stuffing, payment fraud, or lateral movement).

Vulnerable vs. Patched Code

Since no patch is available, we analyze the likely vulnerable pattern.

Vulnerable Code (Hypothetical):

// In a plugin file, e.g., give-divi-debug.php
function give_divi_log_debug($data) {
    $log_file = WP_CONTENT_DIR . '/uploads/give-divi-debug.log';
    file_put_contents($log_file, json_encode($data), FILE_APPEND);
}

This code writes sensitive data to a publicly accessible file without any access control.

Patched Code (Expected):

function give_divi_log_debug($data) {
    // Use WordPress transient or database instead of file
    set_transient('give_divi_debug_' . uniqid(), $data, HOUR_IN_SECONDS);
    // Or store in a non-web-accessible directory
    $log_file = WP_CONTENT_DIR . '/uploads/give-divi-debug.log';
    if (file_exists($log_file)) {
        // Add .htaccess to deny access
        file_put_contents(dirname($log_file) . '/.htaccess', "Deny from all\n");
    }
    file_put_contents($log_file, json_encode($data), FILE_APPEND);
}

The patched version would either avoid writing to a web-accessible location or add server-level access controls (e.g., .htaccess or web.config).

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with Give – Divi Donation Modules <= 2.0.0 installed and activated.
• Knowledge of the file path (common patterns: /wp-content/plugins/give-donation-modules-for-divi/, /wp-content/uploads/give-donation-modules/).

Step-by-Step Exploitation:

1. Enumerate potential sensitive files:

   curl -s -o /dev/null -w "%{http_code}" https://target.com/wp-content/plugins/give-donation-modules-for-divi/debug.log
   curl -s -o /dev/null -w "%{http_code}" https://target.com/wp-content/uploads/give-donation-modules/config.json
   

2. Retrieve sensitive data:

   curl https://target.com/wp-content/plugins/give-donation-modules-for-divi/debug.log
   

3. Parse for credentials:

   curl -s https://target.com/wp-content/uploads/give-donation-modules/config.json | jq '.stripe_secret_key'
   

Expected Output: JSON or plaintext containing API keys, database credentials, or donor information.

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for requests to suspicious paths:

  /wp-content/plugins/give-donation-modules-for-divi/*.log
  /wp-content/uploads/give-donation-modules/*.json
  

• Alert on 200 responses to these paths from external IPs.

Hardening:

1. Immediately block access to plugin directories:

   # .htaccess in wp-content/plugins/give-donation-modules-for-divi/
   <FilesMatch "\.(log|json|txt)$">
       Require all denied
   </FilesMatch>
   

2. Remove any existing sensitive files:

   find /var/www/html/wp-content/ -name "*.log" -path "*give*" -delete
   

3. Update WordPress and plugins (once patch is available).

Indicators of Compromise (IOCs)

• File Paths:
  • /wp-content/plugins/give-donation-modules-for-divi/debug.log
  • /wp-content/uploads/give-donation-modules/config.json
  • /wp-content/uploads/give-donation-modules/backup.json
• Network Patterns:
  • HTTP GET requests to the above paths with 200 status codes.
  • User-Agent strings indicating automated scanning (e.g., curl, python-requests, Go-http-client).
• Log Entries:
  • Apache/Nginx access logs showing "GET /wp-content/plugins/give-donation-modules-for-divi/debug.log HTTP/1.1" 200.
• File Hashes (example):
  • debug.log SHA256: a1b2c3d4e5f6... (if known).

Detection Engineering

YARA Rule

rule CVE_2025_22633_Sensitive_File_Access {
    meta:
        description = "Detects attempts to access sensitive files in Give – Divi Donation Modules plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-22633"
    strings:
        $s1 = "give-donation-modules-for-divi" nocase
        $s2 = "debug.log" nocase
        $s3 = "config.json" nocase
        $s4 = "backup.json" nocase
    condition:
        any of ($s1) and any of ($s2, $s3, $s4)
}

Sigma Rule

title: CVE-2025-22633 Give Divi Donation Modules Sensitive File Access
id: 8f9e2c1a-3b4d-5e6f-7a8b-9c0d1e2f3a4b
status: experimental
description: Detects HTTP requests to sensitive files in Give – Divi Donation Modules plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-stem|contains:
            - '/wp-content/plugins/give-donation-modules-for-divi/debug.log'
            - '/wp-content/uploads/give-donation-modules/config.json'
            - '/wp-content/uploads/give-donation-modules/backup.json'
    condition: selection
falsepositives:
    - Legitimate admin debugging (rare)
level: high

Suricata Rule

alert http any any -> $EXTERNAL_NET any (msg:"CVE-2025-22633 Give Divi Donation Modules Sensitive File Access"; flow:to_server,established; content:"GET"; http_method; content:"/wp-content/plugins/give-donation-modules-for-divi/debug.log"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)
alert http any any -> $EXTERNAL_NET any (msg:"CVE-2025-22633 Give Divi Donation Modules Config Access"; flow:to_server,established; content:"GET"; http_method; content:"/wp-content/uploads/give-donation-modules/config.json"; http_uri; classtype:attempted-recon; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Remove any publicly accessible sensitive files from the web root.
2. Add access controls via .htaccess or server configuration to deny access to plugin directories.
3. Rotate any exposed credentials (API keys, database passwords, etc.).
4. Monitor logs for unauthorized access attempts.

Long-Term Fix:

• Vendor Patch: Await an official update from StellarWP. Until then, consider disabling the plugin if not critical.
• Code Hardening: If you have developer access, modify the plugin to store sensitive data in the WordPress database (e.g., wp_options table) or in a non-web-accessible directory (e.g., outside wp-content).
• Alternative Plugin: Evaluate replacing Give – Divi Donation Modules with a more secure donation integration.

Workaround:

• Use a Web Application Firewall (WAF) to block requests to known sensitive paths.
• Implement file integrity monitoring (e.g., OSSEC, Tripwire) to detect unauthorized file creation.

Valters IT
DevSecOps & Cyber Threat Intelligence