GiveWP CVE-2026-42642

The CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication, no user interaction, no elevated privileges, and no special network position - any internet-accessible WordPress site running GiveWP ≤ 4.14.5 is exposed by default. The specific GiveWP endpoint, AJAX action, or REST route that lacks the authorization check is not named in the available data; the Patchstack advisory contains the precise technical detail. Exploitation is bounded by the impact ceiling of C:L/I:N/A:N - an attacker gains read-only access to restricted data but cannot modify plugin configuration, donor records, or payment data, and cannot disrupt site availability. The vulnerability only affects installations where the GiveWP plugin is actively installed and enabled; WordPress sites without GiveWP, or those running version 4.14.6 or later (pending confirmation of the patched release), are not affected.

The CVSS 3.1 score of 5.3 (Medium) is broadly consistent with the available signals but warrants careful prioritization. The AV:N/AC:L/PR:N vector means exploitation requires no local access, no special conditions, and no credentials - a broad attack surface. However, impact is constrained to C:L/I:N/A:N, indicating limited read-only information disclosure with no write or availability consequence. EPSS at 0.03% (8th percentile) is very low, strongly suggesting this vulnerability has not attracted meaningful attacker attention to date. SSVC confirms exploitation status as 'none' but flags automatable=yes, meaning any future exploit could be scripted for mass scanning - this is the primary escalation risk to monitor. No CISA KEV listing and no known POC further reduce urgency. Net assessment: this is a real but low-urgency finding; patching is warranted on the normal maintenance cycle but does not require emergency response. Sites using GiveWP to handle donation data (donor PII, giving history) should weigh the confidentiality impact more heavily.

An attacker conducting automated WordPress plugin reconnaissance identifies a site running GiveWP ≤ 4.14.5 and sends a crafted unauthenticated HTTP request directly to the improperly protected endpoint. With no authentication barrier, no complexity requirement, and SSVC confirming the attack is automatable, the request bypasses the missing authorization check and returns restricted data - potentially donor records, configuration details, or other confidential plugin data. The attack requires no user interaction and is trivially scriptable against large numbers of WordPress sites simultaneously.