The GiveWP plugin for WordPress suffers from a missing capability check in the give_reports_earnings() function, which leads to unauthorized disclosure of sensitive earnings report information. This vulnerability affects all versions up to 3.22.0. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, requiring low privileges, no user interaction, and impacts confidentiality but not integrity or availability.

An attacker without authentication privileges can access sensitive financial data contained in earnings reports generated by the GiveWP plugin. This unauthorized data disclosure could lead to privacy violations or leakage of confidential fundraising information. There is no reported impact on data integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin's reporting features and monitor for updates from the vendor. Avoid exposing the plugin's endpoints publicly if possible.