Description

Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-13T14:17:13.010Z",
  "pubdate": "2026-08-13T14:17:13.010Z",
  "executiveSummary": "An unauthenticated broken access control vulnerability has been identified in GiveWP versions prior to 4.16.6. This security flaw allows unauthenticated remote attackers to bypass authorization mechanisms and interact with restricted functionalities or data within the affected WordPress plugin. GiveWP, a widely used donation and fundraising plugin for WordPress, is susceptible to this vulnerability, which exposes administrative or sensitive operational endpoints without requiring prior authentication or valid session tokens. The risk implications are severe, as successful exploitation may lead to unauthorized data exposure, state modification, or privilege escalation within the context of the WordPress installation. The attacker capabilities are constrained only by the specific access boundaries breached by the flaw, enabling malicious actors to execute unauthorized requests over the network without user interaction. Exploitation requirements are minimal due to the lack of authentication checks on the targeted endpoints. Remediation requires immediate upgrading of the GiveWP plugin to version 4.16.6 or later to enforce proper access control checks and secure vulnerable functions against unauthorized invocation.",
  "technicalDetails": "The technical root cause of the vulnerability stems from insufficient or absent authorization checks within specific controller methods, AJAX handlers, or REST API endpoints implemented by the GiveWP plugin. In affected versions below 4.16.6, the codebase fails to properly validate whether an incoming HTTP request originates from an authenticated user possessing the requisite capabilities or administrative privileges before executing sensitive application logic.\nThe vulnerability is exposed over the network via standard HTTP/HTTPS protocols, making any publicly accessible WordPress site running a vulnerable version of GiveWP a potential target. Because the flaw is unauthenticated, attackers do not need to provision valid user credentials, bypass login forms, or hijack existing sessions to interact with the vulnerable components.\nThe attack flow proceeds as follows: An unauthenticated malicious actor crafts a specialized HTTP request targeting the exposed GiveWP endpoint or function. Due to the absence of robust access control enforcement and nonce verification routines in the affected code paths, the application processes the incoming request and performs the requested actions. Depending on the exact nature of the vulnerable component, the payload behavior may include retrieving sensitive donor information, altering plugin settings, or triggering unauthorized backend operations.\nThe vulnerable component resides within the core codebase of the GiveWP plugin prior to version 4.16.6, specifically affecting modules responsible for handling restricted operations where authorization validation was omitted or implemented incorrectly. Post-exploitation impact depends on the specific logic exposed by the flawed endpoint, potentially allowing attackers to compromise the integrity and confidentiality of the donation platform and the broader WordPress environment."
}