Pi‑hole Donor Data Exposed via GiveWP Plugin Vulnerability
What Happened
In July 2025 a vulnerability in the GiveWP WordPress donation plugin was leveraged to extract the names and email addresses of roughly 30 k donors to the Pi‑hole ad‑blocking project. Pi‑hole disclosed the breach to Have I Been Pwned (HIBP), confirming the exposure of 29 926 records.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the need for continuous third‑party SaaS risk monitoring; a single plugin flaw can compromise donor data.
- Highlights the importance of maintaining up‑to‑date vulnerability management and patching cycles for all components of a public‑facing service.
- Provides a real‑world example of why a control‑assurance program must document data‑flow inventories and evidence of protective controls (e.g., encryption‑at‑rest, access reviews) to satisfy audit inquiries.
Who Is Affected
- Non‑profit and open‑source projects that accept donations through WordPress‑based forms.
- SaaS providers that embed third‑party plugins for payment or data collection.
- Any organization that stores personally identifiable information (PII) such as names and email addresses without additional safeguards.
Recommended Actions
- Conduct an immediate inventory of all third‑party plugins and verify they are running the latest patched versions.
- Review data‑classification policies; ensure donor PII is treated as sensitive and protected accordingly.
- Validate that continuous monitoring controls (e.g., vulnerability scanning, automated patch deployment) are in place and logging is retained for audit trails.
- Request a post‑incident report from the plugin vendor (GiveWP) and confirm remediation steps were applied.
- Update incident‑response playbooks to include scenarios where a supply‑chain component introduces a breach vector.
Technical Notes
- Attack vector: Exploitation of a known vulnerability in the GiveWP WordPress plugin (specific CVE not disclosed).
- CVEs: None publicly assigned at time of reporting; monitor GiveWP advisories for updates.
- Data types exposed: Email addresses, full names (donor PII).
Source: https://haveibeenpwned.com/api/v3/breach/ThePi-Hole