The GiveWP WordPress plugin suffers from a missing capability check (CWE-862) in the registerAssociateFormsWithCampaign function, enabling unauthenticated users to associate donation forms with arbitrary campaigns. This lack of authorization validation permits unauthorized modification of campaign associations within the plugin. The vulnerability affects all versions up to and including 4.10.0. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No patch or vendor advisory is currently provided.

The vulnerability allows unauthenticated attackers to modify data by associating donation forms with campaigns without proper authorization. This could lead to unauthorized manipulation of donation campaigns, potentially affecting fundraising integrity. There is no impact on confidentiality or availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin or disable it if possible to prevent exploitation. Monitor for updates from the vendor (stellarwp) regarding patches or mitigations.