The GiveWP plugin for WordPress suffers from a missing capability check (CWE-862) in its 'handle_request' function, which governs event ticket settings when the Events beta feature is active. This lack of authorization verification enables unauthenticated users to alter event ticket configurations, potentially impacting the integrity and availability of event-related data. The vulnerability affects all versions up to 3.13.0 and has a CVSS v3.1 base score of 6.5, reflecting a network attack vector with low attack complexity, no privileges required, no user interaction, and impacts limited to integrity and availability.

An attacker without authentication can modify event ticket settings, which may disrupt event management or fundraising activities relying on the plugin. The impact is limited to integrity and availability of event ticket data; confidentiality is not affected. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the Events beta feature if it is not required, to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once released.