Background: a serious flaw in a widely used plugin<\/h2>\n\n\n\n
The GiveWP - Donation Plugin and Fundraising Platform<\/strong> plugin, used by at least 100,000 WordPress sites to manage donations, was recently hit by an information exposure flaw (CWE-200)<\/strong>.<\/p>\n\n\n\n This vulnerability allows anyone<\/strong> to retrieve the list of donors<\/strong> - names, email addresses, credentials - without needing to be logged in or have special privileges.<\/p>\n\n\n\n And all this, simply by visiting a site.<\/p>\n<\/div>\n\n\n\n If you use GiveWP, you should know that this flaw allows an ordinary visitor<\/strong> to collect your donors' information<\/strong>. And we're talking about sensitive personal data here: first name, last name, email, donor ID...<\/p>\n\n\n\n \u27a1\ufe0f Direct risks :<\/strong><\/p>\n\n\n\n The community was quick to react, and not gently.<\/p>\n\n\n\n The Github page for this problem<\/a><\/strong> was flooded with messages of dissatisfaction, some of them furious. Support reportedly ignored the problem at first.<\/p>\n\n\n\n Each intervention by the Community Manager results in a shower of downvotes \ud83d\udc4e<\/strong>.<\/p>\n\n\n\n One user sums it up well: \"This was not a minor issue. This was a massive security and privacy issue?<\/em>\"<\/p>\n\n\n\n The difficulty, of course, is to manage the data leakage from disgruntled customers...<\/p>\n\n\n\n \"We, as the responsible party, self-reported to Troy Hunt and HIBP so they could notify the donor affected. I am receiving emails from rightfully upset donors that do not care that GiveWP was the cause of the leak, they care the Pi-hole had their data, Pi-hole caused their data to be released and thus Pi-hole will be responsible for their damages. We are getting threats of action against us under GDPR.\"<\/p>\ndschaper<\/a> - From GitHub Comment<\/a><\/cite><\/blockquote>\n\n\n\n Here are the actions to take immediately<\/strong>:<\/p>\n\n\n\n This is the only version that fixes<\/strong> this vulnerability.<\/p>\n\n\n\n In concrete terms... If you had the plugin, then the risk is present as soon as a single visitor has been able to visit your site. The more popular the site, the greater the risk.<\/p>\n\n\n\n Transparency = trust.<\/strong> If you have the slightest doubt about an actual leak, take the lead:<\/p>\n\n\n\n If the leak represents a risk for the rights and freedoms<\/strong> of the people concerned (which is often the case with names + emails), you have 72 hours to declare it to the CNIL<\/strong> after becoming aware of it.<\/p>\n\n\n\n \u26a0\ufe0f This is an obligation under the RGPD (Article 33).<\/p>\n\n\n\n \u2795 If the risk is high, you must also inform the people concerned directly<\/strong>.<\/p>\n\n\n\n More info on : https:\/\/www.cnil.fr\/fr\/notifier-une-violation-de-donnees-personnelles<\/a><\/p>\n\n\n\n <\/p>\n\n\n\n At LRob, only one site has this plugin, and the plugin is deactivated there. No impact to report, then.<\/p>\n\n\n\n A flaw like this reminds us that even the most popular plugins can carry risks.<\/p>\n\n\n\n \ud83d\udee1\ufe0f Protect your donors. Strengthen your security. Stay up-to-date.<\/strong><\/p>\n\n\n\n Tired of having to monitor every vulnerability, every plugin, every CVE?<\/p>\n\n\n\n With the web hosting LRob<\/strong><\/a>you benefit from automated monitoring<\/strong>a real-time blocking<\/strong> and clear notifications<\/strong> when a problem is detected. If need be, we'll take care of everything for you thanks to the webmastering offers<\/a>.<\/p>\n\n\n\n \ud83d\udc49 All our services on www.lrob.fr<\/a> \ud83d\ude80\ud83d\udd12<\/p>\n\n\n\n <\/p>","protected":false},"excerpt":{"rendered":"Technical details<\/h2>\n\n\n\n
\n
What are the practical consequences?<\/h2>\n\n\n\n
\n
(Very) strong reactions on Github<\/h2>\n\n\n\n
![\"Example](\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/Un-dev-se-prend-une-shitstorm-givewp.jpg\")
<\/figure>\n\n\n\n\n
What if you use GiveWP?<\/h2>\n\n\n\n
\ud83d\udd04 1. update GiveWP to version 4.6.1<\/h3>\n\n\n\n
\ud83d\udd0d 2. Checks whether data may have been exposed<\/h3>\n\n\n\n
\ud83d\udce2 3. inform your users in the event of a leak<\/h3>\n\n\n\n
\n
\ud83c\udfdb\ufe0f 4. In France: Notify CNIL if necessary<\/h3>\n\n\n\n
Impact at LRob<\/h2>\n\n\n\n
I guess we still don't host enough associations.<\/p>\n\n\n\nUseful resources for further reading<\/h2>\n\n\n\n
\n
In conclusion: stay vigilant<\/h2>\n\n\n\n
\ud83d\udca1 Need a hand with safety?<\/h2>\n\n\n\n