Description

Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T15:17:03.240Z",
  "pubdate": "2026-08-18T15:17:03.240Z",
  "executiveSummary": "An unauthenticated broken access control vulnerability has been identified in the GiveWP plugin affecting versions prior to 4.16.6. This security flaw allows unauthenticated remote attackers to bypass authorization mechanisms and interact with restricted application functionality without requiring valid user credentials or session tokens.\nThe vulnerability exposes the affected WordPress installation to potential unauthorized data access, state manipulation, or administrative function execution depending on the underlying exposed endpoints. Because exploitation requires no authentication and can be executed remotely over the network, the overall risk implication is considered severe.\nThe root cause stems from improper restriction of operations or missing capability checks within the access control logic of the vulnerable component. Attackers can leverage this flaw by directly issuing crafted HTTP requests to unprotected routes, thereby circumventing the intended security boundaries implemented by the application architecture.",
  "technicalDetails": "The vulnerability resides in the access control implementation of the GiveWP plugin for versions strictly prior to 4.16.6. Specifically, the affected component fails to enforce proper authentication and authorization checks prior to processing requests destined for sensitive functionality.\nFrom an architectural perspective, the vulnerability involves missing function-level access control where endpoints or AJAX handlers fail to validate the caller's authentication status or assigned user roles. This allows unauthenticated threat actors interacting with the application over the network to invoke methods intended exclusively for privileged users.\nThe exploitation method relies on sending crafted HTTP requests directly to the exposed vulnerable endpoints. Since the application does not validate session tokens, cookies, or cryptographic nonces associated with an authenticated administrative or privileged context, the request is processed as valid.\nThe attack flow proceeds as follows: First, the attacker identifies the exposed vulnerable endpoint within the GiveWP plugin. Second, the attacker crafts a malicious HTTP request targeting this function without supplying any credentials. Third, the plugin processes the input parameters and executes the underlying logic without verifying user privileges. Finally, the attacker achieves unauthorized execution, leading to potential data exposure or state alteration.\nThe network exposure is external, meaning any remote attacker with network connectivity to the WordPress site can initiate the exploit. No specialized privileges or prior system access are required, drastically lowering the attack complexity."
}