CVE-2026-106600 Overview
CVE-2026-106600 is a missing authorization vulnerability in the Liquid Web / StellarWP GiveWP plugin for WordPress. The flaw affects all GiveWP versions up to and including 4.18.0. An unauthenticated remote attacker can exploit incorrectly configured access control security levels to interact with functionality that should require authentication. The weakness maps to CWE-862: Missing Authorization and primarily impacts data integrity on affected WordPress sites running the plugin.
Critical Impact
Network-reachable attackers can bypass access controls on GiveWP endpoints without authentication or user interaction, enabling limited unauthorized modifications to plugin data.
Affected Products
- Liquid Web / StellarWP GiveWP plugin for WordPress
- All versions from unspecified initial release through 4.18.0
- WordPress sites with the GiveWP donation plugin installed and active
Discovery Timeline
- 2026-10-08 - CVE-2026-106600 published to the National Vulnerability Database
- 2026-10-08 - Last updated in NVD database
Technical Details for CVE-2026-106600
Vulnerability Analysis
GiveWP is a widely deployed WordPress donation plugin maintained by StellarWP. The vulnerability stems from one or more plugin endpoints that fail to enforce proper capability or authorization checks before performing privileged actions. An attacker reaches the vulnerable functionality over the network without credentials and without user interaction.
The impact is scoped to integrity. The flaw does not directly disclose confidential data and does not degrade availability. However, unauthorized modification of donation plugin state can still produce operational and financial consequences for site operators.
Root Cause
The root cause is a broken access control pattern classified under [CWE-862]. Code paths exposed by the plugin perform sensitive operations without verifying that the requester holds the required WordPress capability or nonce. This authorization gap allows anonymous callers to reach handlers intended for privileged users.
Attack Vector
Exploitation requires only HTTP(S) access to the target WordPress site. An attacker crafts a request to an affected GiveWP endpoint and the server processes it without validating authorization. No credentials, tokens, or victim interaction are necessary. Refer to the Patchstack Vulnerability Report for additional technical context.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-106600
Indicators of Compromise
- Unexpected POST or GET requests to GiveWP REST routes or admin-ajax.php actions originating from unauthenticated sessions.
- Unexplained modifications to donation forms, campaign records, or plugin settings in the WordPress database.
- Spikes in traffic to GiveWP-specific endpoints from a narrow range of IP addresses.
Detection Strategies
- Review web server access logs for requests to GiveWP endpoints that lack a valid wp_nonce parameter or authenticated session cookie.
- Correlate WordPress audit log entries for changes to GiveWP configuration against the authenticated user context at the time of change.
- Deploy WordPress-aware web application firewall rules that flag unauthenticated access to plugin administrative actions.
Monitoring Recommendations
- Enable verbose logging on admin-ajax.php and the WordPress REST API, retaining logs for at least 90 days.
- Alert on anomalous write operations to GiveWP database tables outside of normal administrative hours.
- Monitor the installed GiveWP version across your WordPress estate and flag any instance at or below 4.18.0.
How to Mitigate CVE-2026-106600
Immediate Actions Required
- Inventory all WordPress sites running GiveWP and identify any instance at version 4.18.0 or earlier.
- Apply the vendor-released patch above 4.18.0 as soon as it is available in your maintenance window.
- Restrict access to the WordPress admin surface and plugin endpoints using IP allowlisting where feasible.
Patch Information
StellarWP addresses this issue in GiveWP versions released after 4.18.0. Consult the Patchstack Vulnerability Report for the fixed version identifier and upgrade guidance. Update through the WordPress plugin manager or by deploying the patched release through your configuration management pipeline.
Workarounds
- Deactivate the GiveWP plugin on non-production or unused sites until the patched version is deployed.
- Place the vulnerable endpoints behind a web application firewall rule that requires an authenticated session.
- Enforce least-privilege roles for all WordPress users and rotate administrative credentials after patching.
# Example WP-CLI commands to inventory and update GiveWP
wp plugin get give --field=version
wp plugin update give --version=latest
wp plugin list --name=give --status=active
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
