Description

Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T15:17:03.653Z",
  "pubdate": "2026-08-18T15:17:03.653Z",
  "executiveSummary": "An unauthenticated broken access control vulnerability has been identified in the GiveWP plugin affecting versions 4.16.5.1 and prior.\nThis vulnerability allows unauthenticated remote attackers to bypass access restrictions and potentially interact with sensitive functionalities within the application.\nThe flaw introduces significant risk to web applications utilizing the affected versions of the GiveWP product by exposing administrative or restricted operations without requiring valid user credentials.\nThe attacker capabilities include unauthorized execution of privileged actions exposed by the vulnerable access control implementation over the network.\nSuccessful exploitation requires network connectivity to the targeted WordPress instance running the vulnerable GiveWP versions.\nNo specialized privileges or authentication tokens are required to initiate the attack vector, making it accessible to external threat actors.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate or missing access control checks within the request handling logic of the GiveWP plugin.\nSpecifically, sensitive endpoints, functions, or REST API routes fail to properly validate the session, capabilities, or authentication status of the incoming requester.\nThis allows unauthenticated adversaries to directly invoke backend methods or access restricted resources that should be strictly gated behind administrative or authorized user roles.\nThe vulnerable component resides within the GiveWP plugin codebase for versions <= 4.16.5.1, where security boundaries between unauthenticated users and privileged roles are improperly enforced.\nThe attack flow proceeds as follows: First, the unauthenticated attacker identifies the exposed endpoint or function handling the restricted action within the GiveWP plugin.\nSecond, the attacker crafts a malicious HTTP request targeting this resource, omitting any valid authentication headers, cookies, or nonces.\nThird, due to the absence of proper authorization validation routines, the application processes the request and executes the underlying logic.\nFinally, the attacker achieves unauthorized execution, potentially leading to data modification, information disclosure, or further system compromise depending on the targeted function.\nNetwork exposure is fully external, as the vulnerable endpoints are accessible over standard HTTP/HTTPS protocols via the WordPress REST API or direct AJAX handlers.\nThe post-exploitation impact includes unauthorized state changes within the donation management system, potential data tampering, and potential leverage for chained exploits against the underlying WordPress installation."
}