Pi-hole Discloses Donor Email Security Incident
Pi-hole has revealed a security breach that exposed donor email addresses through a vulnerability in their WordPress donation system. The open-source DNS filtering project confirmed that names and email addresses provided during donations were publicly accessible in webpage source code.
What Information Was Compromised
The breach affected only names and email addresses submitted through Pi-hole's donation form. Financial information remained secure as payment processing is handled externally by Stripe and PayPal. The Pi-hole product itself remains unaffected by this incident.
Timeline of Discovery
On July 28, 2025, Pi-hole began receiving reports from donors about suspicious emails. The team traced the issue to their donation page plugin after users reported seeing donor information exposed through simple 'view page source' actions. Reddit posts and Discourse forum discussions helped identify the problem.
Plugin Vulnerability Identified
The security flaw existed in GiveWP, a WordPress donation plugin. Version 4.6.1 contained a critical patch addressing 'donor information visibility.' An archived GitHub issue shows the vulnerability allowed public access to donor data through page source inspection.
Response and Responsibility
Pi-hole expressed disappointment in GiveWP's handling of the security fix and communication timeline. While the patch was released within hours of the report, official notification was delayed. Pi-hole has taken full responsibility for the incident and apologized to affected donors, emphasizing their commitment to rebuilding trust.