CVE-2026-14319: GiveWP WordPress Information Disclosure

CVE-2026-14319 Overview

CVE-2026-14319 is an information disclosure vulnerability in the GiveWP WordPress plugin versions before 4.16.3. The plugin fails to restrict access to a REST API endpoint that returns recurring-donation records. Unauthenticated attackers can query this endpoint to retrieve details about anonymous recurring donors, including names and subscription information. The flaw maps to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). GiveWP is a widely deployed donation and fundraising plugin for WordPress, making the exposure particularly relevant for nonprofits and charitable organizations relying on donor anonymity.

Critical Impact
Unauthenticated remote attackers can enumerate anonymous recurring donor identities and subscription metadata through an unprotected REST API endpoint, breaking donor privacy expectations.

Affected Products

GiveWP WordPress plugin versions prior to 4.16.3
WordPress sites running vulnerable GiveWP installations with recurring donations enabled
Nonprofit and charity websites processing anonymous recurring contributions via GiveWP

Discovery Timeline

2026-07-31 - CVE-2026-14319 published to the National Vulnerability Database
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-14319

Vulnerability Analysis

The vulnerability resides in a REST API endpoint exposed by the GiveWP plugin that returns recurring-donation records. The endpoint lacks a proper permission callback or capability check, so WordPress does not enforce authentication before returning data. As a result, any unauthenticated HTTP client can issue a request and receive donation records that include donor names and subscription details.

Anonymous donation is a core privacy feature GiveWP advertises to donors. When the endpoint returns these records without access control, the anonymity guarantee collapses. Attackers can enumerate donor identities, correlate them with public campaigns, and extract subscription metadata such as renewal cadence and status.

The issue is a broken access control problem on a REST route rather than a code injection or memory-corruption flaw. Confidentiality is directly impacted; integrity and availability are not affected, consistent with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Root Cause

The root cause is a missing or insufficient permission_callback on the recurring-donations REST route registered by the plugin. WordPress REST API routes require an explicit permission callback to enforce authorization; when this callback returns true or is absent, the route becomes publicly accessible. GiveWP versions before 4.16.3 did not restrict this route to authenticated users with donation-management capabilities.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker sends an HTTP GET request to the vulnerable REST endpoint under /wp-json/ and parses the JSON response containing donor and subscription records. No credentials, tokens, or user interaction are required. The attack is scriptable and can be automated across many WordPress sites running GiveWP.

No verified proof-of-concept code has been published. See the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-14319

Indicators of Compromise

Unauthenticated HTTP requests to GiveWP REST routes under /wp-json/give-api/ or similar paths returning 200 OK with donation record payloads
Repeated GET requests from a single IP enumerating recurring-donation endpoints without prior authentication cookies
Access log entries showing bulk retrieval of JSON responses containing donor names or subscription IDs
Outbound data volumes from wp-json endpoints exceeding baseline for the site

Detection Strategies

Inventory WordPress installations and identify GiveWP plugin versions below 4.16.3 using site scanners or WP-CLI
Deploy web application firewall rules that flag unauthenticated requests to GiveWP recurring-donation REST routes
Review historical access logs for anonymous access patterns against /wp-json/ paths registered by GiveWP
Correlate suspicious REST API traffic with known scanner user agents targeting WordPress plugins

Monitoring Recommendations

Forward WordPress and reverse proxy access logs to a centralized SIEM for continuous analysis
Alert on spikes in /wp-json/ requests originating from single source IPs or non-browser clients
Track plugin inventory and version drift across all managed WordPress sites
Monitor egress payload sizes from REST endpoints to detect bulk data extraction attempts

How to Mitigate CVE-2026-14319

Immediate Actions Required

Update GiveWP to version 4.16.3 or later on all affected WordPress sites without delay
Audit recent access logs for unauthenticated requests to GiveWP REST endpoints and identify potentially exposed donor data
Notify donors whose anonymity may have been compromised in line with applicable privacy regulations
Restrict access to /wp-json/ at the reverse proxy or WAF layer where feasible until patching is complete

Patch Information

The GiveWP maintainers addressed the issue in version 4.16.3 by enforcing proper authorization on the recurring-donation REST endpoint. Site operators should upgrade through the WordPress plugin manager, WP-CLI (wp plugin update give), or by deploying the latest package from the vendor. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable the GiveWP plugin until the update to 4.16.3 can be applied if recurring donations are not in active use
Block unauthenticated requests to GiveWP REST routes at the WAF or reverse proxy layer
Restrict /wp-json/ access to authenticated sessions using a security plugin or custom rest_authentication_errors filter
Temporarily disable public REST API access for anonymous users where operationally acceptable

bash

# Configuration example: update GiveWP via WP-CLI
wp plugin update give --version=4.16.3
wp plugin list --name=give --fields=name,status,version