Skip to main content

GiveWP CVE-2026-73349

| EUVDEUVD-2026-57912 MEDIUM
Missing Authorization (CWE-862)
2026-08-13 Patchstack GHSA-22r8-gvpx-mqwv
Authentication Bypass Givewp
5.3
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
vuln.today AI
5.3 MEDIUM

Unauthenticated network exploitation confirmed by PR:N and AV:N; impact is integrity-only with no confidentiality or availability effect per description and CVSS signal.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

2
Analysis Generated
Aug 13, 2026 - 15:10 vuln.today
Patch available
Aug 13, 2026 - 15:02 EUVD

DescriptionCVE.org

Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.

AnalysisAI

Broken access control in GiveWP, the WordPress donation management plugin, allows unauthenticated remote attackers to perform unauthorized integrity-affecting actions against installations running versions prior to 4.16.6. Rooted in CWE-862 (Missing Authorization), the flaw is network-exploitable with no authentication and low attack complexity, making it trivially automatable at scale against the plugin's widespread nonprofit and charity WordPress install base. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify WordPress site with GiveWP active
Delivery
Confirm plugin version below 4.16.6
Exploit
Send unauthenticated HTTP request to vulnerable endpoint
Execution
Bypass missing authorization check
Impact
Perform unauthorized data modification
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No special conditions required for initial access - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms unauthenticated exploitation from the network against default GiveWP configurations with no user interaction needed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score of 5.3 (Medium) reflects a genuinely mixed risk posture: the attack surface is broad (AV:N/AC:L/PR:N/UI:N means any internet-accessible site is reachable by any unauthenticated actor with trivial effort), but the impact envelope is narrow (I:L only - no confidentiality loss, no availability disruption). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker enumerates WordPress sites running a GiveWP version below 4.16.6 - trivially discoverable via plugin header files or response fingerprinting - and sends a crafted HTTP request to the vulnerable endpoint without any session or authentication token. The missing authorization check allows the request to succeed, enabling unauthorized modification of donation records, campaign settings, or other plugin-managed data. …
Remediation Vendor-released patch: GiveWP 4.16.6. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Givewp

View all
CVE-2024-8353 CRITICAL POC
9.8 Sep 28

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

CVE-2024-5932 CRITICAL POC
9.8 Aug 20

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

CVE-2026-14319 HIGH POC
7.5 Jul 31

GiveWP WordPress plugin before 4.16.3 exposes sensitive donor privacy data through an unauthenticated REST API endpoint

CVE-2026-14318 MEDIUM POC
6.8 Jul 30

Stored cross-site scripting in the GiveWP WordPress plugin before version 4.16.3 allows authenticated users holding the

CVE-2025-0912 CRITICAL
9.8 Mar 04

The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.
CVE-2022-2260 MEDIUM POC
6.5 Aug 01

The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exp
CVE-2022-0252 MEDIUM POC
6.1 Feb 21

The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute i
CVE-2021-24213 MEDIUM POC
6.1 Apr 12

The GiveWP - Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-S
CVE-2019-9909 MEDIUM POC
6.1 Mar 22

The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS. Rated me
CVE-2024-9634 CRITICAL
9.8 Oct 16

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

CVE-2024-37099 CRITICAL
9.8 Aug 19

Deserialization of Untrusted Data vulnerability in Liquid Web GiveWP allows Object Injection.14.1. Rated critical severi
CVE-2019-13578 CRITICAL
9.8 Aug 15

A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Rated critical sever

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-73349 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy