GiveWP EUVD-2026-80196

Exploitation requires a target donor record whose e-mail is linked to a WordPress user account - ideally an administrator - within GiveWP before 4.16.8.1 (affected 4.16.6 onward). The attacker must supply an e-mail string that differs from the stored value yet resolves to it under the plugin's inconsistent normalisation (e.g. case, surrounding whitespace, or alias/dot variations), which is the AC:H barrier. No authentication (PR:N) and no user interaction (UI:N) are needed. The practical limiter is knowledge of a valid donor e-mail that maps to a privileged account plus discovery of the exact normalisation-mismatch input; a public WPScan exploit reduces the difficulty of constructing that input.

This is a genuine high-priority issue despite modest exploitation-probability signals. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1) describes an unauthenticated, network-reachable flaw with full C/I/A impact - the ability to reset an administrator's WordPress password equals complete site takeover. The AC:H metric is the sole meaningful brake: the attacker must craft an e-mail value that is treated as equivalent on lookup but differs from the normalised stored form, and must target a donor record linked to a privileged account. Countervailing signals are mixed: EPSS is low at 0.18% (8th percentile), and the CVE is NOT on CISA KEV, so there is no evidence of active mass exploitation. However, a public exploit exists (WPScan), which materially raises real-world risk versus a theoretical bug. The low EPSS against a public POC plus admin-takeover impact suggests exploitation is feasible but not yet widespread/automated - consistent with an emerging rather than commodity threat. Net: treat as urgent patch priority for any GiveWP-running site, weighting impact and POC availability over the currently-low EPSS.

An unauthenticated attacker identifies (or registers) a donor e-mail that maps to a privileged WordPress user, then submits a non-normalised variant of that address (e.g. differing case, whitespace, or dot/alias formatting) so the plugin's lookup resolves them as that donor. Because a public exploit is available (WPScan), the attacker uses it to trigger the password-set flow and assign a new WordPress password to the administrator account linked to the donor, then logs in with full admin control. The AC:H rating reflects that the attacker must know or discover a donor-to-admin linkage and craft the exact normalisation-mismatch string.