GiveWP CVE-2026-96333

Exploitation targets the GiveWP donation payment workflow: the attacker must be able to reach a site running the GiveWP plugin at version 4.16.8.1 or earlier with an active, public-facing donation form, and abuses the payment-confirmation/identity validation (CWE-290 spoofing) to have a donation accepted without a legitimately cleared payment. Per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are required, so any unauthenticated visitor can attempt it against default donation configurations. The practical limiting factor is that impact is confined to donation/transaction integrity (C:N/A:N) - it does not grant WordPress authentication, admin access, or server control - and the site must actually have GiveWP installed and a donation form exposed.

Signals are mixed and lean toward moderate, targeted risk rather than mass exploitation urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw, which normally implies high exploitability; however the impact is narrow (C:N/I:H/A:N), affecting integrity only, consistent with a payment/identity-spoofing bypass rather than data theft or code execution. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no evidence of active or at-scale exploitation at time of analysis. The reference title from Patchstack characterizes this as a 'payment bypass' rather than a full administrative authentication bypass, which tempers the real-world severity: the attacker spoofs a payment/identity to the donation workflow, not to WordPress admin. Treat this as a meaningful integrity issue for sites processing real donations (potential revenue loss / fraudulent 'paid' records) but not a critical server-compromise priority. Note a nuance to verify with the vendor: the CWE-290 spoofing classification and 'payment bypass' reference suggest the true attack surface is the donation payment-confirmation flow, so the I:H rating reflects transaction-integrity loss rather than site-wide integrity compromise.

An attacker interacts with a public GiveWP donation form and spoofs the payment-confirmation/identity data so the plugin records a donation as completed without a valid payment actually clearing. This yields fraudulent 'paid' donations, gated content, or receipts without real funds transferring. No public exploit code was identified at time of analysis, and the CVSS low-complexity, no-interaction vector means a crafted request to the donation endpoint is sufficient.