EUVD-2026-40905
GHSA-7jgp-xppm-6ff3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft forged AJAX request targeting give_set_notification_status_handler
-
DeliveryHost payload on attacker-controlled page or embed in phishing email
-
ExploitTrick authenticated WordPress admin into clicking link
-
ExecutionBrowser submits request with valid admin session cookie
-
PersistServer processes request without nonce check
-
ImpactDonation email notifications silently disabled
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target WordPress site has GiveWP version 4.15.3 or earlier installed and active. The attacker must socially engineer a currently authenticated site administrator into visiting an attacker-controlled URL or page (UI:R); a logged-out administrator or a non-administrator user cannot trigger the vulnerable handler with useful effect. The CVSS vector confirms PR:N - the attacker themselves requires no account or privileges on the target site. Exploitation is limited to modifying email notification state; it does not grant code execution, data access, or persistent access. The attack is limited to the scope of what give_set_notification_status_handler() controls, meaning only donation email notification toggling is affected. |
| Impact | The CVSS 3.1 base score of 4.3 (Medium) accurately reflects the bounded impact of this vulnerability. The vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N confirms network reachability with no complexity or attacker privileges required, but mandates active administrator interaction (UI:R), which is the primary limiting factor. The integrity impact is Low (I:L) and confined to toggling a notification setting - no data exfiltration, no code execution, and no service disruption. No EPSS data was supplied, and CISA KEV status is not confirmed, so exploitation likelihood must be assessed as low based on available signals. No public proof-of-concept code has been identified. The real-world operational risk is moderate for organizations that depend on real-time donation alerts: silently disabled notifications could delay responses to fraudulent donations or cause missed fundraising targets. This is a low-priority patch target from a pure security standpoint but may carry business-impact relevance for nonprofit operators. |
| Exploit ScenarioDerived | An attacker crafts a malicious webpage or email containing an invisible auto-submitting HTML form that targets the GiveWP AJAX endpoint with parameters to disable donation email notifications. When a WordPress site administrator who is currently logged in visits or clicks the attacker-controlled link, the browser submits the forged request bearing the admin's valid session cookie, and the server processes it without nonce validation - silently disabling donation alerts. No public proof-of-concept exploit has been identified, but the attack is trivial to implement given the CSRF pattern. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 01, 2026
Cross-Site Request Forgery in GiveWP - Donation Plugin and Fundraising Platform (versions up to and including 4.15.3) allows unauthenticated remote attackers to disable donation email notifications by tricking a logged-in administrator into clicking a crafted link. The root cause is absent nonce validation in the give_set_notification_status_handler() AJAX handler, permitting forged state-changing requests. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; however, the integrity impact - silently disabling donation notifications - could cause operational blind spots for nonprofit or fundraising site operators.
RemediationAI
Upgrade GiveWP to version 4.15.4 or later; this is inferred as the patched release from the Trac changeset diff between tags 4.15.3 and 4.15.4 (https://plugins.trac.wordpress.org/changeset?old_path=%2Fgive/tags/4.15.3&new_path=%2Fgive/tags/4.15.4), though the exact fix version has not been independently confirmed via a formal vendor security advisory. Update via the WordPress admin dashboard under Plugins > Installed Plugins > GiveWP > Update, or through WP-CLI with wp plugin update give. If an immediate upgrade is not feasible, a compensating control is to restrict access to WordPress admin-ajax.php endpoints at the web server or WAF layer for unauthenticated or non-administrator origins, though this may interfere with other plugin AJAX functionality. Wordfence users with an active license may have virtual patching available via their firewall rules. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/49954c72-df0d-46ec-a252-8af84dea41bf?source=cve for updated vendor confirmation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GiveWP (CPE: cpe:2.3:a:stellarwp:givewp_-_donation_plugin_and_fundraising_platform:*:*:*:*:*:*:*:*) is a WordPress plugin by StellarWP used for managing donation campaigns and fundraising. The vulnerable code resides in includes/admin/emails/ajax-handler.php, specifically the give_set_notification_status_handler() function (visible at lines 24, 25, and 32 of the 4.15.3 tag). This function handles AJAX requests to toggle donation email notification states but fails to verify a WordPress nonce before acting, violating the standard WordPress security pattern for admin AJAX handlers. CWE-352 (Cross-Site Request Forgery) is the root cause class: the server trusts the authenticated session cookie without requiring proof that the request originated from the legitimate admin interface. A Trac changeset reference between tags 4.15.3 and 4.15.4 indicates that nonce validation was introduced as the remediation.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-reachable CSRF with no attacker privileges, but admin click required (UI:R); impact confined to toggling a notification setting (I:L), no confidentiality or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.15.3 This is due to missing nonce validation on the give_set_notification_status_handler() function. This makes it possible for unauthenticated attackers to disable donation email notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Related Vulnerabilities in GiveWP Plugin CSRF and Stored XSS Vulnerabilities
View all 2More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB