What is the CVSS score of CVE-2026-42642?

CVE-2026-42642 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

GiveWP CVE-2026-42642

EUVD-2026-26213 MEDIUM

Missing Authorization (CWE-862)

2026-04-29 Patchstack

WordPress Authentication Bypass Givewp Wordpress Plugin Stellarwp

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Unauthenticated network access with no complexity barriers; impact confined to partial information disclosure with no integrity or availability consequence confirmed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 02:29 vuln.today

EUVD ID Assigned

Apr 29, 2026 - 11:30 euvd

EUVD-2026-26213

CVE Published

Apr 29, 2026 - 10:40 nvd

MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through <= 4.14.5.

AnalysisAI

Missing authorization in GiveWP (StellarWP's WordPress donation plugin) versions through 4.14.5 permits unauthenticated remote attackers to access restricted functionality due to incorrectly configured access control levels, resulting in partial information disclosure. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special conditions are required, and the SSVC framework rates the attack as automatable - meaning mass scanning is trivially feasible if a public exploit emerges. No public exploit or active exploitation has been identified at time of analysis; EPSS places exploitation probability at just 0.03% (8th percentile), indicating low current real-world risk despite the accessible attack surface.

Technical ContextAI

GiveWP is a widely-used WordPress donation and fundraising plugin developed by StellarWP, identified by CPE cpe:2.3:a:stellarwp:givewp:*:*:*:*:*:*:*:*. The root cause is CWE-862 (Missing Authorization), a class of flaws where software fails to perform or incorrectly performs an authorization check before allowing access to a resource or action. In the WordPress plugin context, this typically manifests as REST API endpoints, AJAX handlers, or admin-facing actions that lack proper capability checks (e.g., current_user_can() calls), allowing lower-privileged or unauthenticated users to invoke functionality intended only for administrators or donors with specific roles. The Patchstack advisory frames this as exploiting incorrectly configured access control security levels, consistent with a misconfigured or absent nonce/capability verification on a specific GiveWP handler.

RemediationAI

Upgrade GiveWP to the first release above version 4.14.5 - the exact patched version number is not independently confirmed in the available data and must be verified via the official StellarWP changelog or the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/give/vulnerability/wordpress-givewp-plugin-4-14-5-broken-access-control-vulnerability?_s_id=cve. If an immediate upgrade is not feasible, a WAF rule targeting the specific vulnerable GiveWP endpoint (identified in the full Patchstack report) can block unauthenticated access; the trade-off is potential disruption to legitimate donation flows if the endpoint is part of the public-facing giving experience. As a compensating control, restricting access to wp-admin and WordPress AJAX endpoints (wp-admin/admin-ajax.php) to known IP ranges reduces exposure but may impede remote site management. Monitor access logs for anomalous unauthenticated requests to GiveWP-specific REST or AJAX routes as a detection measure.