Threats tagged 'ghsa-9x4v-8r28-fx8w'

GiveWP WordPress plugin versions before 4.19.0.1 allow unauthenticated users to view unpublished donation forms. This occurs because the plugin does not check user status or capabilities when rendering donation forms on public front-end routes, exposing draft, pending, private, and scheduled forms that WordPress core normally restricts.