GiveWP CVE-2026-111974

Requires a GiveWP donation form (before 4.19.0.1) that has a configured minimum or fixed donation amount - that configured floor is the exact feature being bypassed. Exploitation works against default behavior with no authentication (PR:N), no user interaction, and no special attacker privileges: the attacker submits a donation specifying a currency other than the one the site/form accepts, so the amount is compared as a bare number and clears the limit. The principal limiting factor is impact scope: the outcome is only that a donation can be made below the intended minimum/fixed value (integrity of donation records/accounting); there is no data disclosure or availability impact, and forms without a configured minimum or fixed amount have nothing to bypass.

This is a moderate, low-urgency business-logic flaw rather than a top-priority emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N = 5.3 Medium) is internally consistent with the description: remote, unauthenticated, low-complexity, no user interaction, and only a low integrity impact (C:N, A:N). It is NOT in CISA KEV and no EPSS score was supplied, so widespread or automated exploitation is not evidenced. The only exploitation signal is a single WPScan reference labeled as an exploit, but the input marks it as reference-only, not verified working exploit code - so a public PoC reference exists; it is not verified as working exploit code. The vuln.today decision label is 'this_month', consistent with medium severity and no confirmed active exploitation. The practical impact is financial/accounting integrity (donations accepted below a form's configured minimum or fixed amount) rather than data theft or code execution; the 'Information Disclosure' tag conflicts with the C:N vector and appears mislabeled. Net: a real but low-impact issue worth patching on a normal monthly cycle, not an incident-response-grade priority.

An unauthenticated visitor submits a donation to a GiveWP form whose currency differs from the amount the form validates, so that the raw numeric amount falls below the form's configured minimum or fixed donation value. Because GiveWP compares the amount as a bare number without normalizing for currency, the under-minimum donation is accepted. A public PoC reference exists (WPScan); it is not verified as working exploit code.