The GiveWP plugin for WordPress suffers from an information exposure vulnerability (CWE-200) due to improper permission checks in the 'permissionsCheck' function. Authenticated users with minimal privileges (Subscriber-level and above) can bypass intended access controls to retrieve sensitive data such as donor reports and donation amounts. This vulnerability affects all versions up to 3.22.1. The CVSS 3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to confidentiality loss.

An attacker with an authenticated WordPress account at Subscriber level or higher can access sensitive donor information and donation amounts that should be restricted. This exposure compromises the confidentiality of donor data but does not affect the integrity or availability of the system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles and permissions to trusted users only and monitor access to sensitive reports. Avoid granting Subscriber-level or higher access to untrusted users. Follow updates from the vendor for a security patch addressing this issue.