Cross-Site Request Forgery in GiveWP WordPress Plugin

Executive Summary

The GiveWP plugin for WordPress has a vulnerability known as Cross-Site Request Forgery (CSRF) in versions up to and including 4.15.3. This occurs because the function give_set_notification_status_handler() lacks nonce validation, which is a security measure to verify legitimate requests.

As a result, an attacker who is not authenticated can trick a site administrator into performing an unintended action, such as clicking on a malicious link, which then disables donation email notifications on the site.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects the GiveWP WordPress plugin versions up to and including 4.15.3 due to missing nonce validation in the give_set_notification_status_handler() function. Detection involves identifying if the vulnerable plugin version is installed on your WordPress site.

To detect the presence of the vulnerable GiveWP plugin version on your system, you can check the plugin version via the WordPress admin dashboard or by inspecting the plugin files directly.

From the command line, you can use the following commands to check the installed GiveWP plugin version:

• Navigate to the WordPress plugins directory, usually wp-content/plugins/givewp, and open the main plugin file (e.g., givewp.php) to check the version header.
• Run a command like: grep 'Version:' wp-content/plugins/givewp/givewp.php
• Alternatively, use WP-CLI to check the plugin version: wp plugin list --status=active | grep givewp

Network detection of exploitation attempts is challenging because the attack requires tricking an administrator into clicking a forged request. Monitoring for unusual POST requests to endpoints related to notification status changes in the GiveWP plugin may help.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to disable donation email notifications by tricking an administrator into clicking a malicious link. This can lead to missed notifications about donations, potentially affecting the site's ability to track or respond to donations properly.

While it does not directly compromise data confidentiality or availability, it impacts the integrity of the notification process, which could disrupt communication and operational workflows related to donations.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability exists in GiveWP plugin versions up to and including 4.15.3 due to missing nonce validation in the give_set_notification_status_handler() function.

To mitigate this vulnerability, immediately update the GiveWP plugin to a version later than 4.15.3 where the issue is fixed.

Additionally, ensure that site administrators are cautious about clicking on suspicious links that could trigger forged requests.

Useful 0 Not Useful 0