CVE-2024-5941: 
WordPress vulnerability analysis and mitigation

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress contains a vulnerability (CVE-2024-5941) that allows unauthorized access and deletion of data. The issue affects all versions up to and including 3.14.1, due to a missing capability check on the 'handle_request' function. This security flaw was disclosed on August 19, 2024 (NVD Database).

The vulnerability stems from a missing capability check on the 'handle_request' function in the plugin's codebase. This security weakness is classified as CWE-862 (Missing Authorization). The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L (Wordfence Advisory).

The vulnerability enables authenticated attackers with Subscriber-level access and above to read attachment paths and delete attachment files. This could lead to unauthorized access to sensitive information and potential data loss through file deletion (NVD Database).

The vulnerability can be exploited by any authenticated user with Subscriber-level privileges or higher. The attack requires low complexity and no user interaction, making it relatively straightforward to exploit (Wordfence Advisory).

Users are advised to update their GiveWP plugin to a version newer than 3.14.1. The vulnerability has been patched in subsequent releases (WordPress Patch).