GiveWP EUVD-2026-114310

Affects GiveWP WordPress donation plugin versions <= 4.19.0.1. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) this is remote and unauthenticated against a default installation with no user interaction, so the primary precondition is simply that a reachable site runs a vulnerable GiveWP version. The specific endpoint, parameter, or plugin feature whose authorization check is missing is NOT described in the available sources, so the exact trigger cannot be stated with confidence. Limiting factors on real-world impact: the flaw yields only low confidentiality and low integrity impact (C:L/I:L, no availability effect), so an attacker gains access to or modification of a bounded subset of plugin data rather than full site takeover.

This is a moderate-priority issue rather than a top-tier emergency. The CVSS 6.5 (medium) vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N is highly favorable to attackers on the access side - fully remote (AV:N), low complexity (AC:L), no privileges (PR:N) and no user interaction (UI:N) - meaning any unauthenticated remote attacker can reach the flaw against a default install. What holds the score down is impact: only low confidentiality and low integrity (C:L/I:L) with no availability effect, consistent with a CWE-862 missing-authorization flaw exposing or allowing modification of a bounded set of plugin data rather than full compromise. The vuln.today decision label is 'this_month', not 'act_now' or 'emergency', which aligns with the medium severity. Key corroborating signals are ABSENT from the input: no EPSS exploitation-probability score is provided, the CVE is NOT listed in CISA KEV, and no SSVC breakdown is supplied - so exploitation likelihood cannot be quantified from the data given. The only reference is the Patchstack advisory database entry, which is a vendor/coordinator advisory, not working exploit code. Net: a genuinely remote-unauthenticated but limited-impact access-control bug on a popular WordPress plugin - worth patching in the normal monthly cycle, not a drop-everything event.

A remote, unauthenticated attacker sends a crafted request directly to a GiveWP plugin endpoint on a vulnerable WordPress site (<= 4.19.0.1) that fails to enforce an authorization check, allowing them to read or alter data they should not have access to. No credentials, user interaction, or special timing are required. No public exploit code is identified in the provided data; the single reference is the Patchstack advisory, not a verified working exploit.