The GiveWP plugin for WordPress suffers from an improper authorization vulnerability (CWE-285) in the give_update_payment_status() function. This function lacks a proper capability check, allowing authenticated users with Worker-level permissions or above to modify donation statuses directly. This unauthorized modification capability is not exposed via the user interface, indicating the issue arises from backend function access controls. The vulnerability affects all versions up to 4.5.0 and has a CVSS 3.1 base score of 4.3, reflecting a medium severity impact primarily on integrity. No patch or remediation information is currently available from the vendor or public advisories.

An attacker with authenticated access at the Worker-level or higher can modify donation statuses without proper authorization. This could lead to unauthorized changes in donation records, potentially impacting data integrity and trustworthiness of donation information. There is no indication of confidentiality or availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Worker-level access to trusted users only and monitor for unusual activity related to donation status changes. Avoid granting elevated permissions unnecessarily. Follow vendor updates for any forthcoming patches or official mitigations.