EUVD-2026-94928
GHSA-g422-2gxf-r76f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running GiveWP ≤4.18.0
-
ExploitSend crafted unauthenticated HTTP request
-
ExecutionReach endpoint missing authorization check
-
ImpactPerform unauthorized data modification
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must be a WordPress site running the GiveWP (give) plugin at version 4.18.0 or earlier. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required, so any internet-reachable vulnerable installation is exposed by default. The description attributes the flaw to 'Incorrectly Configured Access Control Security Levels,' implying the vulnerable endpoint enforces no or insufficient authorization; the primary limiting factor is the narrow impact - integrity-only (I:L), with no confidentiality or availability consequence - bounding what an attacker can actually achieve to unauthorized modification of plugin-scoped data rather than full compromise. |
| Impact | This is a moderate-severity (CVSS 5.3) broken/missing access control flaw (CWE-862) in the GiveWP WordPress donation plugin, reported by Patchstack. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated issue requiring no user interaction, but the impact is deliberately narrow: integrity-only (I:L) with no confidentiality or availability impact (C:N/A:N) and unchanged scope (S:U), which is why the score lands at 5.3 rather than critical. No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit (POC) referenced, so there is no evidence of active exploitation or weaponization - this is a priority-to-patch issue for GiveWP operators but not an emergency. The signals are consistent rather than conflicting: a genuinely unauthenticated endpoint with only limited integrity impact. Note that 'Authentication Bypass' appears as a tag while the CWE and CVSS describe missing authorization on an endpoint rather than a full auth bypass; treat the limited I:L impact as the authoritative bound. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted HTTP request directly to a GiveWP endpoint that fails to enforce an authorization check, allowing them to invoke an action or modify data they should not be able to reach on a vulnerable WordPress site (GiveWP ≤ 4.18.0). Because the CVSS impact is integrity-only (I:L), the realistic outcome is limited unauthorized modification of plugin-controlled data rather than data theft or site takeover. No public proof-of-concept is referenced, and exploitation requires no authentication or user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
GiveWP, a WordPress donation and fundraising plugin, ships with a missing-authorization flaw (CWE-862) in versions through 4.18.0 that allows remote attackers to perform unauthorized actions against plugin-scoped data without authenticating or interacting with a victim. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) confines impact to a limited integrity loss with no confidentiality or availability effect, so the realistic outcome is unauthorized modification of donation-related or plugin configuration data rather than full site compromise. Any internet-reachable WordPress installation running the affected range is exposed by default; no public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is tracked by Patchstack and as EUVD-2026-94928.
RemediationAI
No fixed version is identified in the available data: the affected range runs through 4.18.0, so the corrective release would be the first GiveWP version published after 4.18.0 - confirm the exact fixed version and release date in the vendor/W.org plugin changelog and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-18-0-broken-access-control-vulnerability?_s_id=cve) before treating any specific build as patched, and update the plugin through the WordPress dashboard or WP-CLI once confirmed. Until a patched build is verified, apply compensating controls: if the site does not actively use GiveWP for donations, deactivate and delete the plugin (the cleanest option, with the side effect of removing donation history display and any shortcodes/forms); if it is in active use, place the site behind a WAF rule or reverse-proxy rule that blocks unauthenticated POST/GET traffic to the plugin's REST routes (under /wp-json/give-api/ and related namespaces) and admin-ajax.php actions whose 'action' parameter begins with 'give_', accepting the trade-off that legitimate front-end donation submissions may also be throttled or blocked until the rules are tuned. Additional hardening with lower operational risk includes restricting wp-admin and admin-ajax.php to trusted IP ranges, requiring authentication where the donation flow permits it, keeping a file-integrity/audit plugin logging to detect unexpected changes to GiveWP settings, forms, or donation records, and reviewing recent plugin data for unauthorized modifications. Monitor the advisory and any CISA/KEV update, since exploitation status could change; note that none of these compensating controls removes the underlying missing-authorization defect, so prompt upgrade remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-862 Missing Authorization condition in the GiveWP WordPress plugin (slug 'give'), distributed by Liquid Web / StellarWP and fingerprinted as cpe:2.3:a:liquid_web_/_stellarwp:givewp:*:*:*:*:*:*:*:*. In WordPress plugin architecture, sensitive operations are normally gated either by capability checks (current_user_can() with an appropriate role/capability) in admin-ajax or admin-post handlers, or by a permission_callback in register_rest_route() calls that validates the caller before the handler executes. Patchstack characterizes the root cause as 'Incorrectly Configured Access Control Security Levels,' meaning the affected endpoint(s) either enforce no permission callback at all or enforce one that is trivially satisfied, so an unauthenticated request reaches functionality that should require donor, editor, or administrator privileges. The CVSS vector confirms this: PR:N and UI:N establish that no credentials or victim interaction are needed, while the C:N/I:L/A:N sub-scores show the attacker can alter some plugin-managed state but cannot read protected data or degrade availability. Because the impact is integrity-only and scoped to the plugin, the flaw does not provide a direct route to remote code execution, credential theft, or site-wide takeover; it matters primarily where unauthorized changes to donation records, forms, or plugin settings carry financial, reputational, or data-integrity consequences.
Know when Givewp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated network endpoint missing authorization (PR:N/AV:N/AC:L), no user interaction, yielding limited unauthorized modification only (I:L) with no confidentiality or availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through 4.18.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Unauthenticated PHP object injection in the GiveWP WordPress donation plugin (all versions through 4.16.7.1) lets remote
Improper privilege management in the GiveWP WordPress donation plugin (affected ranging from 4.16.6 up to but not includ
GiveWP WordPress plugin before 4.16.3 exposes sensitive donor privacy data through an unauthenticated REST API endpoint
Stored cross-site scripting in the GiveWP WordPress plugin before version 4.16.3 allows authenticated users holding the
The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.
The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exp
The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute i
The GiveWP - Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-S
The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS. Rated me
Deserialization of Untrusted Data vulnerability in GiveWP GiveWP allows Object Injection.19.3. Rated critical severity (
Exploit-DB