CVE-2026-32425: GiveWP Pix Gateway Auth Bypass Flaw

CVE-2026-32425 Overview

CVE-2026-32425 is a missing authorization vulnerability [CWE-862] affecting the linknacional Payment Gateway Pix For GiveWP WordPress plugin. The flaw exists in versions up to and including 2.2.3. The plugin enforces incorrectly configured access control security levels, allowing unauthenticated network-based attackers to reach functionality that should be restricted.

Successful exploitation results in a limited integrity impact without affecting confidentiality or availability. The vulnerability requires no privileges and no user interaction. The Patchstack advisory categorizes the issue as broken access control in a WordPress payment gateway integration.

Critical Impact

Unauthenticated attackers can interact with protected plugin functionality due to missing authorization checks, modifying data within the GiveWP donation workflow.

Affected Products

• linknacional Payment Gateway Pix For GiveWP plugin versions through 2.2.3
• WordPress sites running GiveWP with the Pix payment gateway integration enabled
• Donation processing workflows dependent on the vulnerable plugin

Discovery Timeline

• 2026-03-13 - CVE-2026-32425 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-32425

Vulnerability Analysis

The vulnerability stems from missing authorization checks within the Payment Gateway Pix For GiveWP plugin. The plugin exposes functionality without verifying that the requesting user holds the required capability or role. This pattern aligns with CWE-862: Missing Authorization, where the application does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attackers reach the vulnerable endpoints over the network without authentication. The attack complexity is low and no user interaction is required. The impact is limited to integrity, meaning an attacker can modify data exposed by the plugin but cannot directly read protected content or disrupt availability.

The EPSS probability of exploitation is currently 0.04%, placing this issue in the 12th percentile of CVEs by predicted exploitation activity. No public proof-of-concept code or in-the-wild exploitation has been confirmed.

Root Cause

The root cause is an incorrectly configured access control security level on one or more plugin actions. Developers did not enforce capability checks such as current_user_can() or nonce validation through check_admin_referer() on handlers that modify state. As a result, the WordPress permission model is bypassed for plugin-specific operations.

Attack Vector

An attacker sends crafted HTTP requests to vulnerable plugin endpoints on a target WordPress site. Because no authentication is required, the request originates from an unauthenticated session. The plugin processes the request and performs the action without validating the caller. Refer to the Patchstack Vulnerability Report for endpoint-level technical details.

Detection Methods for CVE-2026-32425

Indicators of Compromise

• Unexpected modifications to GiveWP donation records, payment metadata, or Pix gateway configuration entries
• Unauthenticated HTTP POST or GET requests to admin-ajax.php or REST routes registered by the payment-gateway-pix-for-givewp plugin
• Plugin-related log entries showing state changes without an associated authenticated WordPress user session

Detection Strategies

• Audit WordPress access logs for requests targeting plugin action handlers from unauthenticated sources
• Compare installed plugin version against 2.2.3 and flag any host running the vulnerable release
• Monitor the WordPress database for unauthorized changes to GiveWP donation or gateway tables

Monitoring Recommendations

• Enable WordPress audit logging to capture privileged actions performed without an authenticated session
• Forward web server and application logs to a centralized SIEM for correlation across donation processing endpoints
• Alert on anomalous request volumes to wp-admin/admin-ajax.php with action parameters tied to the Pix gateway plugin

How to Mitigate CVE-2026-32425

Immediate Actions Required

• Identify all WordPress sites running Payment Gateway Pix For GiveWP at version 2.2.3 or earlier
• Update the plugin to a fixed release as soon as the vendor publishes a patched version
• Restrict administrative endpoints behind a web application firewall rule until patching is complete

Patch Information

The Patchstack advisory tracks this vulnerability as affecting versions through 2.2.3. Site administrators should monitor the Patchstack Vulnerability Report and the plugin repository for the fixed release and apply it across all affected installations.

Workarounds

• Disable the Payment Gateway Pix For GiveWP plugin until a patched version is installed
• Apply WAF rules that block unauthenticated requests to plugin-specific AJAX and REST endpoints
• Limit access to the WordPress admin and AJAX surface by IP allow-listing where operationally feasible

# Configuration example: Nginx rule blocking unauthenticated access to plugin handlers
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "(?i)pix_for_givewp") {
        # Require an authenticated WordPress session cookie
        if ($http_cookie !~* "wordpress_logged_in_") {
            return 403;
        }
    }
}