GiveWP EUVD-2026-89892

No special conditions - remote unauthenticated exploitation (PR:N/UI:N/AC:L) against default configurations of the GiveWP WordPress donation plugin at versions <= 4.16.9. The primary limiting factor is the vulnerability's low technical impact (limited integrity only, no confidentiality or availability effect per I:L/C:N/A:N), meaning successful exploitation permits only bounded unauthorized manipulation of another entity's object rather than data theft or site takeover. Exploitation also depends on the attacker being able to enumerate or predict valid object identifiers; the exact endpoint and parameter are not disclosed in the advisory.

This is a moderate-severity, low-real-risk issue by the numbers. The Patchstack-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N = 5.3) describes an unauthenticated, network-reachable, low-complexity IDOR whose only impact is limited integrity (I:L), with no confidentiality or availability effect. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation. Note a mild internal tension worth verifying: CWE-639 (Authorization Bypass Through User-Controlled Key) and IDOR typically yield information disclosure (a confidentiality impact), yet this vector sets C:N and scores only I:L - the sparse Patchstack description names no parameter or object, so the exact affected object and whether the real impact is read (C) or write (I) cannot be confirmed from the input. Treat the scored I:L-only impact as vendor-asserted but unverified. Overall this is a routine plugin-hardening fix, not an emergency, though GiveWP's broad install base warrants timely patching.

An unauthenticated remote attacker sends a crafted request to a GiveWP endpoint, substituting a guessable or enumerated object identifier to reference a donation, form, or record belonging to another entity without authorization. Because no authentication or user interaction is required (PR:N/UI:N), the request succeeds against default installations, allowing limited unauthorized modification or manipulation of the targeted object (I:L). No public exploit code was identified at time of analysis.