Input validation vulnerability in GiveWP – Donation Plugin and Fundraising Platform 2.33.3

The GiveWP plugin, used in WordPress websites, is vulnerable to a type of attack called Cross-Site Request Forgery in versions up to and including 2.33.3. This is because there is no security measure (called a ‘nonce’) or it is not functioning correctly on the “give_sendwp_remote_install_handler” function. This means that if unauthorised people can get an administrator on a website to click a link, they can install and activate the SendWP plugin.