What is the CVSS score of CVE-2026-14317?

CVE-2026-14317 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-14317?

Yes, a public proof-of-concept exploit is available for CVE-2026-14317. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-14317?

Yes, a patch is available for CVE-2026-14317. Update the affected software to the latest version immediately.

GiveWP CVE-2026-14317

EUVD-2026-51407 MEDIUM

Missing Authorization (CWE-862)

2026-07-31 WPScan

GHSA-r3pc-c6qw-qwpc

WordPress Authentication Bypass Givewp

5.3

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-exploitable with no auth required; integrity impact is low as disabled gateways process unauthorized transactions; no confidentiality or availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 14:26 vuln.today

CVSS changed

Jul 31, 2026 - 14:22 NVD

5.3 (MEDIUM)

Patch available

Jul 31, 2026 - 07:01 EUVD

CVE Published

Jul 31, 2026 - 06:00 cve.org

MEDIUM 5.3

CVE Published

Jul 31, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations through a payment gateway the administrator has disabled.

AnalysisAI

GiveWP WordPress donation plugin before version 4.16.3 allows unauthenticated users to route donations through payment gateways the administrator has explicitly disabled, by supplying a gateway identifier via request input that the plugin fails to validate against the admin-configured allowlist. Rooted in CWE-862 (Missing Authorization), this bypasses financial controls that site operators may have disabled for compliance, fraud prevention, or contractual reasons - making the practical business risk higher than the CVSS Medium score suggests. A publicly available proof-of-concept exists via WPScan; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.

Technical ContextAI

GiveWP is a widely-deployed WordPress plugin for managing online donation campaigns and payment processing. The plugin supports multiple payment gateways (e.g., Stripe, PayPal, offline gateways), with administrators controlling which are active. The vulnerability, CWE-862 (Missing Authorization), arises because the server-side donation submission handler derives the selected payment gateway partially from user-controlled POST/request parameters rather than exclusively from the administrator's persisted configuration. No server-side check enforces that the requested gateway appears in the enabled gateway list before processing the transaction. The affected CPE is cpe:2.3:a:unknown:givewp:*:*:*:*:*:*:*:* covering all versions below 4.16.3.

RemediationAI

Update GiveWP to version 4.16.3 or later immediately; this is the vendor-released patch confirmed by the WPScan advisory at https://wpscan.com/vulnerability/fa6f5470-b30d-4052-aacd-a0571d4678ac/ and NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-14317. The update is available through the standard WordPress plugin repository. If immediate patching is blocked, a targeted compensating control is to disable any payment gateways at the payment processor level (e.g., revoke API keys or deactivate the merchant account for the disabled gateway) rather than relying solely on the GiveWP admin setting - this removes the resource the attacker would exploit even if the plugin routes to it. Note that this approach may disrupt legitimate access to those gateways for future re-enablement. Temporarily deactivating the GiveWP plugin entirely is the strongest compensating control but will halt all donation functionality site-wide until the patch is applied.