The GiveWP WordPress plugin suffers from an improper authorization vulnerability (CWE-285) in its 'registerGetForm', 'registerGetForms', 'registerGetCampaign', and 'registerGetCampaigns' functions. These functions lack proper capability checks, allowing unauthenticated users to retrieve data from private and draft donation forms and archived campaigns. This results in unauthorized information disclosure. The issue affects all versions up to 4.10.0. The CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), indicating network exploitable with low attack complexity, no privileges required, no user interaction, and limited confidentiality and integrity impact.

The vulnerability allows unauthenticated attackers to extract sensitive data from private and draft donation forms and archived campaigns within the GiveWP plugin. This leads to information exposure that could compromise donor privacy or campaign confidentiality. There is no indication of impact on availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the affected plugin features or disabling the plugin if feasible to prevent unauthorized data exposure.