GiveWP CVE-2026-73348

No special conditions are required beyond the target WordPress site having GiveWP installed and running a version prior to 4.16.6. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against default plugin installations without needing any specific non-default configuration toggle to be enabled. What limits exploitation is the requirement that the target site runs WordPress with GiveWP actively installed and enabled - non-WordPress environments and sites without this plugin are unaffected. The scope-unchanged (S:U) rating further limits impact to within the WordPress application boundary, preventing lateral movement to the underlying server OS. The specific internal endpoints lacking authorization checks are not disclosed in the available references, which provides minor obscurity but should not be relied upon as a defense.

The CVSS 6.5 medium score is supported by a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, indicating low-complexity unauthenticated network exploitation with limited but real confidentiality and integrity impact and no availability consequence. No EPSS score was provided in the source data, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, nor is there a known public proof-of-concept - all of which moderates immediate alarm. However, the PR:N/AC:L combination means that once a vulnerable endpoint is fingerprinted, exploitation requires no prior access or special tooling, and even a mid-sized municipal IT team in rybnik running WordPress-based fundraising infrastructure should treat this as urgent patching work rather than a deferred item, given donation platforms often process sensitive donor PII and payment metadata. The scope-unchanged (S:U) rating limits blast radius to the WordPress application context, which prevents privilege escalation to the hosting OS. Overall this is a real priority for GiveWP operators, not a high-CVSS-but-low-real-risk false alarm, given the zero-barrier exploitation path.

An unauthenticated remote attacker enumerates a WordPress site running GiveWP below version 4.16.6, then sends a crafted HTTP request directly to an unprotected plugin endpoint that omits WordPress capability verification. The missing authorization check allows the request to succeed, granting the attacker read or write access to donation records, donor data, or plugin configuration that should be restricted to privileged roles. No public POC has been identified, but the low attack complexity (AC:L) and absence of authentication requirements mean exploitation is straightforward once the unprotected route is discovered.