What is the CVSS score of EUVD-2026-51408?

EUVD-2026-51408 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of GiveWP are affected by EUVD-2026-51408?

The GiveWP WordPress plugin (versions before 4.16.3) contains an unauthenticated API vulnerability that exposes detailed donor information-including names and subscription details-to anyone on the…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-51408?

Yes, a public proof-of-concept exploit is available for EUVD-2026-51408. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2026-51408?

Within 24 hours, verify your GiveWP installation version and assess your upgrade readiness for version 4.16.3 or later. Within 7 days, deploy GiveWP version 4.16.3 or later across all production WordPress instances to eliminate the vulnerability. Within 30 days, conduct a privacy impact assessment to determine which donors may have been exposed, prepare privacy notification communications in accordance with your privacy policies and applicable regulations, and review your WordPress plugin update procedures to expedite future security updates.

GiveWP EUVD-2026-51408

| CVE-2026-14319 HIGH

Information Exposure (CWE-200)

2026-07-31 WPScan

GHSA-f3f2-f9r3-mhc5

WordPress Information Disclosure Givewp

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable REST API with no auth (AV:N, PR:N, AC:L); full donor PII exposed (C:H); no write or denial-of-service impact (I:N, A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 20:22 vuln.today

CVSS changed

Jul 31, 2026 - 20:22 NVD

7.5 (HIGH)

Patch available

Jul 31, 2026 - 07:01 EUVD

CVE Published

Jul 31, 2026 - 06:00 cve.org

HIGH 7.5

CVE Published

Jul 31, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to retrieve information about anonymous recurring donors, including their name and subscription details.

Articles & Coverage 1

News 17 New WordPress Vulnerabilities - 2 Critical, 13 With POC Aug 01, 2026

AnalysisAI

GiveWP WordPress plugin before 4.16.3 exposes sensitive donor privacy data through an unauthenticated REST API endpoint that returns recurring-donation records without access controls. Any unauthenticated remote party can enumerate donor names and subscription details for donors who explicitly chose to give anonymously, directly violating donor privacy expectations. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify WordPress site running GiveWP

Delivery

Query unauthenticated REST API endpoint

Exploit

Retrieve recurring-donation records

Execution

Extract donor names and subscription details

Impact

Deanonymize anonymous donors

Access

Identify WordPress site running GiveWP

Delivery

Query unauthenticated REST API endpoint

Exploit

Retrieve recurring-donation records

Execution

Extract donor names and subscription details

Impact

Deanonymize anonymous donors

Vulnerability AssessmentAI

Exploitation	No special conditions are required for exploitation beyond the GiveWP plugin being installed, active, and having at least one recurring donor record in the database. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects the technical severity: no authentication, no complexity, full confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker sends an HTTP GET request to the GiveWP REST API endpoint that returns recurring-donation records - no credentials, session, or special headers required. The response contains donor names and subscription details for all anonymous recurring donors, allowing the attacker to deanonymize contributors. …
Remediation	Upgrade GiveWP to version 4.16.3 or later, which is the vendor-released patched version confirmed by WPScan and the EUVD advisory. … Detailed patch versions, workarounds, and compensating controls in full report.