Description
The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to retrieve information about anonymous recurring donors, including their name and subscription details.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | GiveWP | < 4.16.3 | 4.16.3 |
References
- https://wpscan.com/vulnerability/f90c88a8-e5a5-4bcf-8fa1-59cdfef015a4/ exploit vdb-entry technical-description