Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

impress-org/give

              develop @ 047f532
            

106

Fixes

CVEs

CRITICAL

Peak severity

30.8%

Coverage

Highlights

Auth Bypass: 46 prior fixes. Scrutinize any change in this area.

includes/class-give-session.php: most-fixed (6 issues). Treat as high-risk during review.

77 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes addressed missing or weak permission callbacks in REST API routes, allowing unauthenticated access to sensitive donation, donor, and subscription data. The high volume of fixes in this area indicates a systemic issue with route-level authorization.

Auth Bypass: Payment gateway routes and AJAX handlers had missing signature validation, nonce checks, and capability checks, enabling unauthorized order creation, account disconnection, and credential saving. These are high-impact financial operations.

Stored XSS: Stored XSS was fixed in multiple components of the donation form rendering pipeline, including form settings (colors, custom CSS), labels, and template output. This indicates a lack of consistent output escaping and input sanitization across form-related features.