What is the CVSS score of CVE-2026-65464?

CVE-2026-65464 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

GiveWP CVE-2026-65464

EUVD-2026-48076 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-23 Patchstack

GHSA-cgvj-9hrm-5wxj

WordPress CSRF Givewp Wordpress Plugin Nexcess

5.4

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

vuln.today AI

5.4 MEDIUM

CSRF is network-exploitable with no attacker credentials (PR:N) but requires victim click (UI:R); no confidentiality impact applies.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:26 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

MEDIUM 5.4

DescriptionCVE.org

Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.

AnalysisAI

Cross-Site Request Forgery in GiveWP WordPress donation plugin versions up to and including 4.16.3 enables unauthenticated remote attackers to forge requests on behalf of authenticated administrators, resulting in limited integrity and availability impact on the affected installation. The CVSS vector (PR:N/UI:R) confirms the attacker requires no server-side credentials but must social-engineer a logged-in victim into triggering the forged request. No active exploitation is confirmed - this CVE is absent from the CISA KEV catalog and no public exploit code has been identified at time of analysis.

Technical ContextAI

GiveWP, developed under the Nexcess vendor namespace (CPE: cpe:2.3:a:nexcess:givewp:*:*:*:*:*:*:*:*), is a widely-deployed WordPress fundraising and donation management plugin. The root cause is CWE-352 (Cross-Site Request Forgery), which occurs when the plugin processes state-changing HTTP requests without validating a per-session anti-forgery token (WordPress nonce). Without nonce verification, a browser will automatically include the victim's authentication cookies in any cross-origin request, allowing an attacker's crafted page to impersonate the authenticated user. The vulnerability is network-exploitable at low complexity, consistent with the typical CSRF pattern in WordPress plugins that omit nonce checks on AJAX handlers or admin-action endpoints.

RemediationAI

Upgrade GiveWP to the version immediately following 4.16.3 as released by the vendor - the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-16-3-cross-site-request-forgery-csrf-vulnerability should be consulted for the exact patched release number, which is not explicitly stated in the available intelligence. Note: an exact fix version is not independently confirmed from the provided data, so verify via the WordPress plugin repository or Patchstack before treating any specific version as safe. As a compensating control while patching is underway, a Web Application Firewall (WAF) rule enforcing same-origin request validation or blocking cross-origin state-changing requests to GiveWP admin endpoints can reduce exposure; however this may interfere with legitimate third-party integrations. Restricting wp-admin access to known IP ranges also narrows the attack surface, at the cost of administrative flexibility for remote staff.