The GiveWP WordPress plugin suffers from a missing capability check in the 'handle_request' function, enabling authenticated users with low privileges (Subscriber and above) to access and delete attachment files. This vulnerability affects all versions up to 3.14.1. The CVSS 3.1 base score is 5.4 (medium), reflecting low confidentiality impact, no integrity impact, and low availability impact. No patch or vendor advisory has been provided yet, and no known exploits are reported in the wild.

An attacker with Subscriber-level access or higher can read sensitive file paths and delete attachment files within the plugin's scope. This could lead to partial denial of service or data loss related to attachments managed by the plugin. The confidentiality impact is limited to disclosure of file paths, with no reported integrity compromise beyond deletion of files. Availability impact is low but present due to potential deletion of attachments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Subscriber-level access to trusted users only and monitor for suspicious activity related to attachment management. Avoid granting unnecessary permissions to low-privilege users. Follow updates from the vendor for an official fix.