Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

impress-org/givewp

              develop @ 047f532
            

110

Fixes

CVEs

CRITICAL

Peak severity

35.9%

Coverage

Highlights

Auth Bypass: 41 prior fixes. Scrutinize any change in this area.

includes/admin/admin-actions.php: most-fixed (5 issues). Treat as high-risk during review.

85 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The most frequent vulnerability class, with many fixes adding missing current_user_can checks to admin actions, REST permission callbacks, and gateway route handlers. A single missing check can expose sensitive operations like settings import, plugin management, and payment account disconnection.

Insecure Deserialization: Multiple fixes restrict unserialize() to prevent object injection, including rejecting serialized data in donation fields and blocking __PHP_Incomplete_Class instances. This is a critical risk because attacker-controlled serialized payloads can lead to RCE.

Stored XSS: Recurring stored XSS in donation form settings (colors, custom CSS), admin donor/payment details, and email previews. Fixes involve sanitizing hex colors, escaping output with esc_html/esc_attr, and using wp_kses_post for rich text.