GiveWP EUVD-2026-109343

Exploitation requires an authenticated WordPress user already assigned a high-privilege GiveWP custom role (PR:H) - anonymous or low-privilege users cannot trigger it. The attacker must be able to reach the GiveWP plugin functionality that reads a user-supplied filename, and the target must run GiveWP before version 4.19.0.1. No user interaction by a victim is needed (UI:N). The decisive limiting factor is the privileged-role prerequisite, which confines this to insider abuse or escalation after an account of that role is already compromised; the specific feature/endpoint accepting the filename is not named in the available sources.

This is a moderate-priority, authenticated privilege-abuse flaw rather than a mass-exploitation emergency, and the signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N) describes a network-reachable, low-complexity attack that nevertheless requires high privileges - specifically a user already holding a high-privilege custom WordPress role - so it is not exploitable by anonymous internet attackers. EPSS is low (0.16%, 5th percentile) and the vulnerability is NOT in CISA KEV, so there is no indication of active or widespread exploitation; a public PoC reference exists (WPScan) but it is not verified as working exploit code, which is a distinct and weaker signal than confirmed exploitation. The vuln.today decision label is 'this_month', which aligns with the picture of a real but non-urgent fix: meaningful confidentiality impact (arbitrary JSON-parseable file disclosure server-wide) tempered by the PR:H precondition. The main real-world risk is post-compromise escalation or abuse by a semi-trusted operator, not perimeter breach. No key signals conflict here; the limiting factor is purely the high-privilege prerequisite.

An attacker who already controls (or has compromised) a WordPress account with a high-privilege GiveWP custom role supplies a crafted filename to the vulnerable plugin endpoint, causing it to traverse out of its intended directory and read an arbitrary JSON-parseable file anywhere on the server (potentially exposing secrets) and to overwrite GiveWP's stored configuration. A public PoC reference exists (WPScan) but it is not verified as working exploit code; realistic exploitation depends on the attacker first obtaining the required privileged role.