Skip to main content

GiveWP EUVDEUVD-2026-60779

| CVE-2026-73352 MEDIUM
Missing Authorization (CWE-862)
2026-08-18 Patchstack GHSA-mr6c-6rqv-xmmh
Authentication Bypass Givewp
6.5
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
vuln.today AI
6.5 MEDIUM

Network-reachable unauthenticated endpoint with no interaction required; impact limited to partial data read/write within the plugin, no availability or scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

2
Analysis Generated
Aug 18, 2026 - 15:37 vuln.today
CVE Published
Aug 18, 2026 - 14:00 cve.org
MEDIUM 6.5

DescriptionCVE.org

Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.

AnalysisAI

Broken access control in GiveWP WordPress plugin versions up to and including 4.16.5.1 allows unauthenticated remote attackers to bypass authorization checks and interact with restricted plugin functionality. Reported by Patchstack (ENISA EUVD-2026-60779), the flaw maps to CWE-862 (Missing Authorization), meaning the plugin fails to verify caller permissions before executing sensitive operations. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Enumerate target WordPress site for GiveWP plugin
Delivery
Identify unprotected endpoint via public plugin source code
Exploit
Send unauthenticated HTTP request to restricted endpoint
Execution
Bypass missing authorization check (CWE-862)
Impact
Access or manipulate donation data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires only that the target WordPress site has GiveWP version 4.16.5.1 or earlier installed and active, with the affected endpoint reachable over the network - which is the default state for any public-facing WordPress site running this plugin. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score of 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N reflects an attack that is trivially accessible - no credentials, no complexity, no user interaction - but limited in its ceiling of damage: partial confidentiality and integrity loss with no availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker identifies a WordPress site running GiveWP 4.16.5.1 or earlier - trivially detectable via plugin enumeration or HTTP headers. The attacker sends a crafted HTTP request (e.g., a POST to an unprotected REST or AJAX endpoint) that triggers a restricted GiveWP operation without supplying credentials. …
Remediation The primary remediation is to update GiveWP to a version above 4.16.5.1 via the WordPress plugin dashboard or the WordPress.org plugin repository. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Givewp

View all
CVE-2024-8353 CRITICAL POC
9.8 Sep 28

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

CVE-2024-5932 CRITICAL POC
9.8 Aug 20

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

CVE-2026-14319 HIGH POC
7.5 Jul 31

GiveWP WordPress plugin before 4.16.3 exposes sensitive donor privacy data through an unauthenticated REST API endpoint

CVE-2026-14318 MEDIUM POC
6.8 Jul 30

Stored cross-site scripting in the GiveWP WordPress plugin before version 4.16.3 allows authenticated users holding the

CVE-2025-0912 CRITICAL
9.8 Mar 04

The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.
CVE-2022-2260 MEDIUM POC
6.5 Aug 01

The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exp
CVE-2022-0252 MEDIUM POC
6.1 Feb 21

The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute i
CVE-2021-24213 MEDIUM POC
6.1 Apr 12

The GiveWP - Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-S
CVE-2019-9909 MEDIUM POC
6.1 Mar 22

The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS. Rated me
CVE-2024-9634 CRITICAL
9.8 Oct 16

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

CVE-2024-37099 CRITICAL
9.8 Aug 19

Deserialization of Untrusted Data vulnerability in Liquid Web GiveWP allows Object Injection.14.1. Rated critical severi
CVE-2019-13578 CRITICAL
9.8 Aug 15

A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Rated critical sever

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-60779 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy