GiveWP EUVD-2026-89886

Exploitation requires an authenticated low-privilege account on the target WordPress site (CVSS PR:L, described as Subscriber level), so the attacker must be able to register or already possess such credentials - this is the primary limiting factor. No user interaction is needed (UI:N) and the attack is remote over the network (AV:N) with low complexity (AC:L). The affected component is the GiveWP donation plugin at versions <= 4.16.9; sites where user self-registration is disabled and no low-privilege accounts exist to attackers are substantially harder to exploit. The exact feature/endpoint enforcing the missing authorization check is not named in the advisory.

This is a moderate-severity broken access control issue (CWE-862) in GiveWP scored CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) by Patchstack. The vector is network-exploitable with low complexity and no user interaction, but critically requires PR:L - a low-privilege authenticated account (Subscriber-level, per the description). Impact is confidentiality-only (C:H) with no integrity or availability effect, consistent with a sensitive-data-exposure flaw where a missing authorization check lets a logged-in low-privilege user read data they should not access. No EPSS score, no CISA KEV listing, and no public POC are provided, so exploitation status is 'no public exploit identified at time of analysis.' Weighing the signals: the C:H is the aggravating factor, but the PR:L requirement (an attacker needs a valid account, and on many donation sites open registration may or may not be enabled) meaningfully limits real-world exploitability compared to an unauthenticated flaw. This is a real but not urgent priority - patch in normal cycles. No conflicting signals were detected in the provided data, though the description is sparse and does not name the exact endpoint, parameter, or data exposed.

An attacker registers or obtains a low-privilege Subscriber account on a WordPress site running GiveWP <= 4.16.9, then invokes an AJAX action or REST/admin endpoint that lacks a proper capability check. The missing authorization allows the account to retrieve sensitive donation or donor data (potentially PII or payment-adjacent details) it is not entitled to see. No public exploit code is identified at time of analysis, and no user interaction from a victim is required.