GiveWP CVE-2026-14319

No special conditions are required for exploitation beyond the GiveWP plugin being installed, active, and having at least one recurring donor record in the database. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against default plugin configurations. Exploitation is limited by: the plugin must be actively used with recurring donations enabled (a non-default feature requiring donor opt-in to subscription giving); and the impact is read-only confidentiality exposure with no code execution, integrity modification, or availability impact. Sites that use GiveWP only for one-time donations without recurring subscriptions may have no donor records exposed through this endpoint.

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects the technical severity: no authentication, no complexity, full confidentiality impact. However, EPSS of 0.16% at the 5th percentile indicates this vulnerability has not been widely exploited in the wild at time of scoring, contrasting with the High CVSS. A publicly available exploit exists (WPScan reference), which elevates real-world risk above what the EPSS alone suggests - exploitation is trivial and tooling is public, but mass exploitation has not materialized. There is no CISA KEV listing, confirming no confirmed active widespread exploitation. The primary real-world risk is targeted privacy breach of donor data rather than systemic compromise; the impact is bounded to confidentiality (no integrity or availability impact). Sites using GiveWP with recurring donors should treat this as a genuine priority due to potential GDPR/privacy regulation exposure from donor PII leakage, even if general exploitation rates appear low.

An unauthenticated attacker sends an HTTP GET request to the GiveWP REST API endpoint that returns recurring-donation records - no credentials, session, or special headers required. The response contains donor names and subscription details for all anonymous recurring donors, allowing the attacker to deanonymize contributors. A publicly available exploit proof-of-concept exists per WPScan, making this trivially reproducible by anyone with the URL pattern.