CVE-2024-5940 is a vulnerability identified in the GiveWP – Donation Plugin and Fundraising Platform, a widely used WordPress plugin designed to facilitate donations and fundraising activities. The issue stems from a missing authorization check (CWE-862) in the 'handle_request' function, which is responsible for processing certain plugin requests. Specifically, when the Events beta feature is enabled, this flaw allows unauthenticated attackers to modify event ticket settings without any capability verification. This lack of proper access control means that attackers can alter event-related data, potentially disrupting fundraising events or manipulating ticket configurations. The vulnerability affects all versions up to and including 3.13.0. The CVSS 3.1 base score is 6.5, indicating a medium severity level, with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, meaning the attack can be performed remotely over the network without privileges or user interaction, impacting integrity and availability but not confidentiality. No patches or exploit code are currently publicly available, and no known exploitation in the wild has been reported. However, the risk remains significant due to the plugin's popularity and the critical nature of fundraising events managed through it.

The vulnerability allows unauthorized modification of event ticket settings, which can lead to data integrity issues such as incorrect ticket pricing, availability, or event details. This can disrupt fundraising campaigns, cause financial losses, and damage organizational reputation. Additionally, the availability of event ticketing features could be impaired, potentially leading to denial of service for legitimate users attempting to participate in events. Since the exploit requires no authentication or user interaction, attackers can easily target vulnerable sites remotely. Organizations relying on GiveWP for critical fundraising activities, especially those using the Events beta feature, face risks of operational disruption and loss of donor trust. The impact is primarily on the integrity and availability of event-related data, which can cascade into broader organizational challenges.

Organizations should immediately verify if the Events beta feature is enabled in their GiveWP plugin installations. If enabled, it is recommended to disable this feature until an official patch or update is released by the vendor. Administrators should monitor for updates from webdevmattcrom and apply security patches promptly once available. Implementing Web Application Firewall (WAF) rules to restrict access to the vulnerable 'handle_request' endpoint can provide temporary protection. Additionally, organizations should audit event ticket settings regularly for unauthorized changes and maintain robust backup procedures to restore data if tampering occurs. Monitoring logs for unusual activity related to event ticket modifications can help detect exploitation attempts early. Finally, limiting exposure by restricting administrative access to trusted IPs and enforcing least privilege principles on WordPress user roles can reduce risk.