GiveWP CVE-2026-73349

No special conditions required for initial access - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms unauthenticated exploitation from the network against default GiveWP configurations with no user interaction needed. Any WordPress installation where GiveWP is installed and active at a version below 4.16.6 is exposed if the site is internet- or network-accessible. Limiting factors include: impact is integrity-only (I:L) with no confidentiality or availability compromise, constraining attacker value per exploitation; the specific vulnerable endpoint or feature is not publicly disclosed, meaning exploitation without patch diffing requires additional research effort; and sites behind network access controls or authenticated proxies have reduced external exposure. No non-default plugin configuration is required for exploitation.

The CVSS 3.1 base score of 5.3 (Medium) reflects a genuinely mixed risk posture: the attack surface is broad (AV:N/AC:L/PR:N/UI:N means any internet-accessible site is reachable by any unauthenticated actor with trivial effort), but the impact envelope is narrow (I:L only - no confidentiality loss, no availability disruption). No EPSS score was provided in the available intelligence, which is a gap for quantified exploitation probability. There is no CISA KEV listing and no reported public proof-of-concept, which reduces urgency relative to higher-KEV findings. However, the combination of zero authentication requirement and a broadly deployed plugin creates meaningful mass-exploitation potential if a POC surfaces. The most material unknown is the exact scope of the integrity modification achievable - without knowing which specific endpoint or action is exposed, defenders cannot precisely scope blast radius. This uncertainty should be treated as a risk amplifier, not a mitigant.

An unauthenticated attacker enumerates WordPress sites running a GiveWP version below 4.16.6 - trivially discoverable via plugin header files or response fingerprinting - and sends a crafted HTTP request to the vulnerable endpoint without any session or authentication token. The missing authorization check allows the request to succeed, enabling unauthorized modification of donation records, campaign settings, or other plugin-managed data. No public exploit code has been identified at time of analysis, but the low attack complexity means a working exploit could be derived from diff analysis of the 4.16.6 patch.