GiveWP EUVD-2026-109346

Requires an authenticated WordPress account that has been granted GiveWP donor-report (view) access but not donor-edit access, on a site running GiveWP before 4.19.0.1; the donor address-change handler performs no capability check. No special plugin configuration beyond the existence and assignment of that report-only capability is needed, and no user interaction is required. Exploitation is limited to the integrity of donor address data (add/modify/delete stored addresses) - there is no confidentiality or availability impact - and it is gated by the attacker already holding the report-level role, so it is primarily an insider / over-provisioned-user risk rather than an unauthenticated internet exposure.

This is a low-severity, low-priority issue despite being network-reachable. The input CVSS of 2.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) reflects an authenticated flaw with only a low integrity impact and no confidentiality or availability impact, consistent with CWE-862 missing authorization. All exploitation signals agree on low urgency: EPSS is 0.13% (3rd percentile), there is no CISA KEV listing, and the vuln.today decision label is 'monitor'. A public PoC reference exists (WPScan) but it is not verified as working exploit code, so it should not be treated as confirmed active exploitation. One internal inconsistency is worth noting: the input vector uses PR:H, but the description indicates the actor is a lower-privilege user who holds only donor-report (view) access rather than an administrator - so PR:L is a more defensible privilege rating, which would not raise the score meaningfully. Net assessment: a genuine broken-access-control bug, but a monitor-and-patch item, not an emergency.

A WordPress user who has been granted GiveWP donor-report (view) access - but deliberately not donor-edit rights - uses the donor address-change handler, which performs no capability check, to add, alter, or delete the stored address of any donor on the site. Because the vector is network-reachable with low complexity and no user interaction, the request can be issued directly once the actor holds the report-only role. A public PoC reference exists (WPScan) but is not verified as working exploit code.