CVE-2026-14317 Overview
CVE-2026-14317 affects the GiveWP donation plugin for WordPress in versions before 4.16.3. The plugin fails to restrict payment gateway selection to those enabled by the administrator. Instead, it derives the active gateway partly from request input supplied by the client. Unauthenticated users can submit donations through payment gateways the administrator explicitly disabled. The issue is categorized under CWE-862: Missing Authorization.
Critical Impact
Unauthenticated attackers can bypass administrator-enforced payment gateway restrictions, routing donations through disabled processors and undermining site operator control over payment flows.
Affected Products
- GiveWP WordPress plugin versions prior to 4.16.3
- WordPress sites accepting donations through GiveWP
- Any GiveWP deployment with one or more payment gateways disabled by an administrator
Discovery Timeline
- 2026-07-31 - CVE-2026-14317 published to NVD
- 2026-07-31 - Last updated in NVD database
Technical Details for CVE-2026-14317
Vulnerability Analysis
The GiveWP plugin exposes donation submission endpoints to unauthenticated users, which is expected behavior for a donation platform. The flaw lies in how the plugin selects the payment gateway that processes a donation request. Instead of validating the requested gateway against the administrator's enabled gateway list on the server, the plugin trusts a value derived from the incoming HTTP request. This constitutes a missing authorization check on a security-sensitive configuration setting.
The vulnerability falls under CWE-862: Missing Authorization. It does not enable code execution or data theft directly. However, it breaks the trust boundary between site administrators and public users by allowing anonymous requests to override server-side gateway policy.
Root Cause
The root cause is improper enforcement of administrator-defined state during donation processing. Payment gateway availability is a server-side configuration decision, yet the plugin partially derives the active gateway from user-controlled request parameters. The code path lacks a comparison between the requested gateway identifier and the persisted list of enabled gateways.
Attack Vector
An unauthenticated attacker submits a donation request over the network and includes a payment gateway identifier for a gateway the administrator has disabled. The plugin accepts the request-supplied gateway and completes the donation flow through it. No authentication, user interaction, or elevated privileges are required. Full technical details are available in the WPScan Vulnerability Advisory.
No public proof-of-concept exploit is currently listed for this CVE, and it has not been added to the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-14317
Indicators of Compromise
- Successful donation records in GiveWP logs referencing payment gateways currently marked as disabled in the plugin settings.
- HTTP POST requests to GiveWP donation endpoints containing payment-gateway or gateway parameter values that do not match the site's enabled gateway configuration.
- Transaction records from third-party payment processors that were expected to be inactive for the site.
Detection Strategies
- Compare the set of payment gateways referenced in GiveWP donation records against the current administrator-enabled gateway list, and flag any mismatch.
- Review web server access logs for POST requests to /wp-admin/admin-ajax.php and GiveWP form submission endpoints with unexpected gateway parameters.
- Monitor the WordPress plugin inventory for GiveWP versions below 4.16.3.
Monitoring Recommendations
- Enable verbose logging on GiveWP donation processing and forward events to a centralized log platform for correlation.
- Alert on any donation completion where the gateway does not appear in the administrator-configured enabled gateway list.
- Track outbound API calls from the WordPress host to payment processor endpoints that should not be active.
How to Mitigate CVE-2026-14317
Immediate Actions Required
- Upgrade GiveWP to version 4.16.3 or later on all WordPress sites.
- Audit recent donation records for transactions processed through disabled gateways and reconcile with payment processors.
- Revoke or rotate API keys for any payment gateway that should not have been reachable through the site.
Patch Information
The vendor addressed CVE-2026-14317 in GiveWP 4.16.3 by restricting available payment gateways to those enabled by the administrator and no longer deriving the selection from request input. Refer to the WPScan Vulnerability Advisory for advisory details.
Workarounds
- Remove or fully uninstall payment gateway integrations that must not be reachable, rather than only disabling them in the GiveWP settings.
- Invalidate credentials at the payment processor for any gateway intended to remain offline until the plugin is upgraded.
- Place the donation endpoints behind a web application firewall rule that rejects requests specifying gateway identifiers outside the approved list.
# Update GiveWP via WP-CLI to the fixed version
wp plugin update give --version=4.16.3
wp plugin list --name=give --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
