What is the CVSS score of CVE-2026-14319?

CVE-2026-14319 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of GiveWP are affected by CVE-2026-14319?

The GiveWP WordPress plugin (versions before 4.16.3) contains an unauthenticated API vulnerability that exposes detailed donor information-including names and subscription details-to anyone on the…. A patch is available.

Is there a public PoC exploit available for CVE-2026-14319?

Yes, a public proof-of-concept exploit is available for CVE-2026-14319. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-14319?

Within 24 hours, verify your GiveWP installation version and assess your upgrade readiness for version 4.16.3 or later. Within 7 days, deploy GiveWP version 4.16.3 or later across all production WordPress instances to eliminate the vulnerability. Within 30 days, conduct a privacy impact assessment to determine which donors may have been exposed, prepare privacy notification communications in accordance with your privacy policies and applicable regulations, and review your WordPress plugin update procedures to expedite future security updates.

GiveWP CVE-2026-14319

EUVD-2026-51408 HIGH

Information Exposure (CWE-200)

2026-07-31 WPScan

GHSA-f3f2-f9r3-mhc5

WordPress Information Disclosure Givewp Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable REST API with no auth (AV:N, PR:N, AC:L); full donor PII exposed (C:H); no write or denial-of-service impact (I:N, A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 20:22 vuln.today

CVSS changed

Jul 31, 2026 - 20:22 NVD

7.5 (HIGH)

Patch available

Jul 31, 2026 - 07:01 EUVD

CVE Published

Jul 31, 2026 - 06:00 cve.org

HIGH 7.5

CVE Published

Jul 31, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to retrieve information about anonymous recurring donors, including their name and subscription details.

Articles & Coverage 1

News 17 New WordPress Vulnerabilities - 2 Critical, 13 With POC Aug 01, 2026

AnalysisAI

GiveWP WordPress plugin before 4.16.3 exposes sensitive donor privacy data through an unauthenticated REST API endpoint that returns recurring-donation records without access controls. Any unauthenticated remote party can enumerate donor names and subscription details for donors who explicitly chose to give anonymously, directly violating donor privacy expectations. A publicly available exploit exists per WPScan reporting, though EPSS sits at the 5th percentile, suggesting limited opportunistic exploitation at time of analysis. No active exploitation is confirmed via CISA KEV.

Technical ContextAI

GiveWP is a WordPress plugin providing donation management functionality, including recurring (subscription-based) donation processing. The vulnerability resides in a REST API endpoint registered by the plugin that surfaces recurring-donation records. WordPress REST API endpoints are publicly reachable by default unless explicitly protected with permission callbacks; CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) describes the root cause: the endpoint lacked a proper capability check or authentication requirement, allowing unauthenticated HTTP clients to query it. Affected CPE is cpe:2.3:a:unknown:givewp:*:*:*:*:*:*:*:* covering all GiveWP versions prior to 4.16.3. The data returned includes donor names and subscription details, which is particularly sensitive since these records correspond to donors who opted for anonymous giving.

RemediationAI

Upgrade GiveWP to version 4.16.3 or later, which is the vendor-released patched version confirmed by WPScan and the EUVD advisory. The fix can be applied via the standard WordPress plugin update mechanism (Dashboard > Plugins > Update Available). If immediate patching is not possible, a compensating control is to disable REST API access for unauthenticated users at the WordPress or web server level (e.g., via the Disable REST API plugin or nginx/Apache rules blocking /wp-json/ for anonymous requests) - note this may break other plugins or themes that depend on public REST API access. Alternatively, restricting network access to the WordPress installation to authenticated sessions only (e.g., via a WAF rule or HTTP Basic Auth at the server level) would prevent unauthenticated enumeration. Reference the WPScan advisory at https://wpscan.com/vulnerability/f90c88a8-e5a5-4bcf-8fa1-59cdfef015a4/ for additional technical detail.