GiveWP – Donation Plugin and Fundraising Platform Vulnerability – Unauthenticated Full Path Disclosure – CVE-2024-6551 | WordPress Plugin Vulnerability Report

Plugin Name: GiveWP – Donation Plugin and Fundraising Platform

Key Information:

• Software Type: Plugin
• Software Slug: give
• Software Status: Active
• Software Author: webdevmattcrom
• Software Downloads: 7,990,636
• Active Installs: 100,000
• Last Updated: September 14, 2024
• Patched Versions: 3.16.0
• Affected Versions: <= 3.15.1

Vulnerability Details:

• Name: GiveWP <= 3.15.1
• Type: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• CVE: CVE-2024-6551
• CVSS Score: 5.3
• Publicly Published: August 28, 2024
• Researcher: stealthcopter
• Description: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Full Path Disclosure in versions up to and including 3.15.1. This vulnerability is due to the plugin’s use of Symfony and leaving display_errors enabled in test files. Unauthenticated attackers can exploit this issue to retrieve the full path of the web application, which could aid in future attacks. However, this information is not harmful by itself and requires additional vulnerabilities to cause real damage to the affected site.

Summary:

The GiveWP – Donation Plugin and Fundraising Platform for WordPress has a vulnerability in versions up to and including 3.15.1 that allows unauthenticated attackers to retrieve full path disclosures due to display_errors being enabled in certain test files. This vulnerability can be exploited to assist in further attacks but is not immediately harmful on its own. The vulnerability has been patched in version 3.16.0.

Detailed Overview:

The vulnerability was discovered by researcher stealthcopter and stems from the GiveWP plugin’s use of the Symfony framework. The plugin inadvertently left display_errors on within test files, which can lead to the full file path being disclosed when errors are triggered. This issue is categorized as Full Path Disclosure, which, while not dangerous on its own, provides valuable information to attackers that could be used in combination with other vulnerabilities. An attacker could use the disclosed file paths to perform reconnaissance, simplifying future attacks like file inclusion or remote code execution.

While the CVSS score of 5.3 indicates moderate risk, the vulnerability becomes more dangerous when combined with other unpatched flaws on the site. Users of the plugin are advised to update immediately to version 3.16.0 to mitigate the risk of exploitation.

Advice for Users:

• Immediate Action: Users of the GiveWP plugin should update to version 3.16.0 or later to address this vulnerability. The patch fixes the issue by disabling display_errors in production environments.
• Check for Signs of Vulnerability: Review your website’s error logs and server settings to ensure display_errors is disabled in production. If you see errors revealing full paths in test files or logs, your site may have been affected.
• Alternate Plugins: While the vulnerability has been patched, users concerned about long-term risks may consider alternate donation or fundraising plugins, although GiveWP remains safe to use after updating.
• Stay Updated: Regularly update all your WordPress plugins to their latest versions. Vulnerabilities are often discovered in widely-used plugins, and keeping everything up to date ensures that your website is protected from potential exploits.

Conclusion:

The prompt response from the GiveWP – Donation Plugin and Fundraising Platform developers to patch this vulnerability demonstrates the importance of regular plugin updates. Users are strongly encouraged to update to version 3.16.0 or later to avoid potential security risks associated with Full Path Disclosure. Regular updates and diligent monitoring are essential to maintaining the security and performance of your WordPress website.

References:

• Wordfence Threat Intelligence - GiveWP Vulnerability
• Wordfence Threat Intel Blog

Detailed Report: 

Keeping your WordPress site secure is crucial, especially when your business relies on plugins to handle sensitive tasks like online donations. Regularly updating your plugins is one of the most effective ways to prevent security breaches. Recently, a vulnerability in the GiveWP – Donation Plugin and Fundraising Platform was discovered, affecting versions up to and including 3.15.1. This vulnerability, identified as CVE-2024-6551, allows unauthenticated attackers to retrieve full file paths from your site, which could be used to exploit other vulnerabilities.

While this Full Path Disclosure issue may not seem harmful on its own, it can serve as a stepping stone for attackers aiming to launch more severe attacks. Thankfully, the vulnerability has been patched in version 3.16.0. If you haven’t updated yet, your website could still be exposed, leaving your donation platform and site at risk. This guide will explain the issue in more detail and provide steps to secure your website.

Plugin Overview:

The GiveWP – Donation Plugin and Fundraising Platform is a popular tool used by WordPress website owners to manage online donations. With nearly 8 million downloads and 100,000 active installs, it’s widely trusted in the nonprofit and fundraising space. However, like any plugin, keeping it updated is essential for maintaining your site’s security.

This vulnerability occurs due to the plugin’s use of the Symfony framework and leaving display_errors enabled in certain test files. This can expose the full path of your website’s files to unauthenticated attackers. While the information revealed by this vulnerability is not harmful by itself, it can aid attackers in conducting more sophisticated attacks, such as remote code execution or file inclusion.

Risks and Potential Impacts:

The Full Path Disclosure vulnerability is rated with a CVSS score of 5.3, which indicates a moderate risk. Attackers can use the exposed file paths to gain insight into your website’s structure, which can simplify the process of launching more advanced attacks. This type of vulnerability typically serves as part of a larger attack strategy, so while it doesn’t directly harm your site, it leaves your site more susceptible to other forms of exploitation.

For websites handling donations, this vulnerability could pose an even greater risk if it’s combined with additional security flaws. The exposed file paths could help attackers find weak points in your system, potentially leading to the compromise of sensitive donor information or your site's functionality.

Remediation:

To mitigate this vulnerability and secure your website, follow these steps:

1. Immediate Action: Update the GiveWP plugin to version 3.16.0 or later. The updated version fixes this issue by disabling display_errors in production environments.
2. Check for Signs of Vulnerability: Review your server settings to ensure display_errors is disabled. Check your error logs for any instances of file paths being exposed, especially in test environments.
3. Consider Alternative Plugins: If you’re particularly concerned about security or are looking for alternatives, there are other donation and fundraising plugins available. However, once updated, GiveWP is a reliable and secure platform for handling donations.
4. Stay Updated: Make sure to enable automatic updates for your plugins or check for updates regularly. Keeping your plugins up to date is the best way to protect your website from emerging vulnerabilities.

Previous Vulnerabilities:

It’s worth noting that GiveWP has experienced 49 vulnerabilities since April 20, 2015. Each vulnerability has been patched in a timely manner by the development team, but this underscores the importance of staying current with plugin updates. Even well-maintained and widely-used plugins like GiveWP can be vulnerable, and ensuring you have the latest version is the most effective defense against potential threats.

Conclusion:

For small business owners and nonprofit organizations managing a WordPress site, keeping up with security vulnerabilities can feel overwhelming. However, the recently discovered vulnerability in GiveWP highlights why it’s crucial to stay on top of plugin updates. By regularly updating your plugins, monitoring for vulnerabilities, and implementing proactive security measures, you can significantly reduce the risk of an attack and protect your website’s functionality and your donors’ sensitive information.

If you don’t have the time to manage these updates, consider enabling automatic updates or working with a web professional to monitor your site. Regular updates and ongoing vigilance are essential to keeping your WordPress site secure in an ever-changing digital landscape.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.