GiveWP CVE-2026-73352

Exploitation requires only that the target WordPress site has GiveWP version 4.16.5.1 or earlier installed and active, with the affected endpoint reachable over the network - which is the default state for any public-facing WordPress site running this plugin. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no elevated privileges, no user interaction, and no complex configuration are required. The primary limiting factor is attacker knowledge of the specific vulnerable endpoint or action name; however, because GiveWP is open-source and its codebase is publicly available on WordPress.org, this barrier is minimal. Impact is bounded to partial confidentiality and integrity (C:L/I:L) - likely read or write access to donation records or plugin configuration - with no availability impact and no scope change to other WordPress components or the host system.

The CVSS 3.1 base score of 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N reflects an attack that is trivially accessible - no credentials, no complexity, no user interaction - but limited in its ceiling of damage: partial confidentiality and integrity loss with no availability impact. The unchanged scope (S:U) indicates no lateral movement beyond the plugin's own data. No EPSS score was supplied in the available data, KEV status is absent (no confirmed active exploitation), and no proof-of-concept has been identified, which are all moderating signals. However, the 'Authentication Bypass' tag and PR:N vector mean the barrier to exploitation is extremely low, and GiveWP's broad install base across nonprofit and charitable WordPress sites significantly amplifies exposure - even a mid-sized municipal IT team in walbrzych running a donation portal on this plugin should treat this as an urgent patching priority rather than a deferred medium. The absence of EPSS data means exploitation probability cannot be quantified; defenders should weight the PR:N accessibility heavily in their prioritization.

An unauthenticated attacker identifies a WordPress site running GiveWP 4.16.5.1 or earlier - trivially detectable via plugin enumeration or HTTP headers. The attacker sends a crafted HTTP request (e.g., a POST to an unprotected REST or AJAX endpoint) that triggers a restricted GiveWP operation without supplying credentials. With no proof-of-concept publicly available, exploitation currently requires knowledge of the specific vulnerable endpoint, but the low attack complexity and plugin's public codebase make reverse-engineering the flaw straightforward for a motivated attacker.