GiveWP CVE-2026-104405

Exploitation requires network access to a WordPress installation with the GiveWP plugin at version 4.17.0 or earlier; no authentication (PR:N) and no user interaction (UI:N) are needed. The primary limiting factor is the High attack complexity (AC:H): the advisory's CVSS vector indicates success depends on conditions the attacker cannot fully control - the specific feature, request sequence, or state that triggers the incorrect privilege assignment is not detailed in the available data, so the exact precondition should be verified against the Patchstack advisory. Sites not running GiveWP, or already updated past 4.17.0, are not affected.

This is a genuinely serious issue by CVSS (8.1 High) but with important mitigating nuance. The vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) describes a network-reachable, fully unauthenticated privilege escalation with complete confidentiality, integrity, and availability impact (C:H/I:H/A:H) - an attacker needs no credentials and no user interaction, which is the worst-case access profile. The key tempering signal is AC:H (High attack complexity), meaning successful exploitation depends on conditions outside the attacker's control (e.g., a race, specific state, or non-trivial preconditions), which lowers the practical exploitation rate relative to an AC:L bug of the same impact. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided in the intelligence, so there is no evidence of active exploitation or mass scanning at this time; the risk is currently theoretical-but-credible rather than confirmed-and-widespread. Because the only source is a single Patchstack advisory with no corroborating vendor advisory or NVD CPE version detail beyond '<=4.17.0', treat the version boundary and the precise exploitation mechanism as not independently verified. Net: prioritize patching given unauthenticated network reach on a popular plugin, but the AC:H gate and absence of exploitation signals argue against emergency-incident treatment.

A remote, unauthenticated attacker targets a WordPress site running the GiveWP donation plugin at version 4.17.0 or earlier and sends crafted requests that exploit an incorrect privilege-assignment flaw (CWE-266) to elevate their effective privileges. Because the flaw is AC:H, the attacker must satisfy specific preconditions or win a timing/state condition before the escalation succeeds. No public exploit code was identified at time of analysis, so exploitation would currently require independent development.