What is the CVSS score of CVE-2026-73348?

CVE-2026-73348 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-73348?

Yes, a patch is available for CVE-2026-73348. Update the affected software to the latest version immediately.

GiveWP CVE-2026-73348

Q: Which versions of GiveWP are affected by CVE-2026-73348?

Broken access control in GiveWP versions prior to 4.16.6 exposes unauthenticated network attackers to partial read and write access over donation-related functionality, bypassing authorization…. A patch is available.

EUVD-2026-60776 MEDIUM

Missing Authorization (CWE-862)

2026-08-18 Patchstack

GHSA-h968-wg7c-wxj2

Authentication Bypass Givewp

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable unauthenticated endpoint (AV:N, PR:N) with low complexity; limited C:L/I:L reflects partial access bypass without full system compromise or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 15:37 vuln.today

Patch available

Aug 18, 2026 - 15:02 EUVD

CVE Published

Aug 18, 2026 - 14:00 cve.org

MEDIUM 6.5

DescriptionCVE.org

Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.

AnalysisAI

Broken access control in GiveWP versions prior to 4.16.6 exposes unauthenticated network attackers to partial read and write access over donation-related functionality, bypassing authorization entirely due to missing capability checks (CWE-862). Reported by Patchstack and tracked under EUVD-2026-60776, the flaw affects all installs of the Nexcess GiveWP WordPress plugin below the patched release. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify WordPress site with GiveWP installed

Exploit

Send unauthenticated HTTP request to unprotected plugin endpoint

Execution

Trigger missing authorization path (CWE-862)

Impact

Read or modify restricted donation data

Access

Identify WordPress site with GiveWP installed

Exploit

Send unauthenticated HTTP request to unprotected plugin endpoint

Execution

Trigger missing authorization path (CWE-862)

Impact

Read or modify restricted donation data

Vulnerability AssessmentAI

Exploitation	No special conditions are required beyond the target WordPress site having GiveWP installed and running a version prior to 4.16.6. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 6.5 medium score is supported by a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, indicating low-complexity unauthenticated network exploitation with limited but real confidentiality and integrity impact and no availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated remote attacker enumerates a WordPress site running GiveWP below version 4.16.6, then sends a crafted HTTP request directly to an unprotected plugin endpoint that omits WordPress capability verification. The missing authorization check allows the request to succeed, granting the attacker read or write access to donation records, donor data, or plugin configuration that should be restricted to privileged roles. …
Remediation	The primary fix is to update GiveWP to version 4.16.6 or later, which contains the vendor-released patch addressing this broken access control. … Detailed patch versions, workarounds, and compensating controls in full report.