CVE-2026-73348: GiveWP Auth Bypass Vulnerability

CVE-2026-73348 Overview

CVE-2026-73348 is a broken access control vulnerability in the GiveWP donation plugin for WordPress. The flaw affects all versions prior to 4.16.6 and can be exploited by unauthenticated attackers over the network. The weakness is classified as Missing Authorization [CWE-862], meaning the plugin exposes functionality without verifying that the requester has permission to invoke it. Because GiveWP handles donation and fundraising workflows, attackers can interact with plugin endpoints intended for privileged users. The vulnerability carries a CVSS 3.1 base score of 6.5 and impacts confidentiality and integrity, but not availability.

Critical Impact
Unauthenticated remote attackers can invoke GiveWP functionality that should require authorization, leading to unauthorized disclosure or modification of donation-related data.

Affected Products

GiveWP plugin for WordPress, all versions prior to 4.16.6
WordPress sites running the vulnerable GiveWP plugin
Donation and fundraising sites relying on GiveWP endpoints

Discovery Timeline

2026-08-18 - CVE-2026-73348 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73348

Vulnerability Analysis

The vulnerability is a Broken Access Control weakness [CWE-862] in the GiveWP WordPress plugin. GiveWP exposes plugin endpoints that fail to verify caller identity or role before executing sensitive operations. An unauthenticated attacker can reach these endpoints over the network without user interaction. According to the Patchstack Vulnerability Report, the issue is resolved in version 4.16.6. The EPSS probability for observed exploitation is 0.194%, placing this issue in the lower percentile of predicted exploit activity at time of publication.

Root Cause

The root cause is missing authorization checks on one or more plugin actions. WordPress plugins typically enforce access using current_user_can() capability checks and nonce validation through check_ajax_referer() or wp_verify_nonce(). When these checks are absent or incorrectly scoped, callable actions execute regardless of the requester's authentication state or role.

Attack Vector

The attack vector is network-based and does not require credentials or user interaction. An attacker sends crafted HTTP requests to a vulnerable GiveWP endpoint on a target WordPress site. Because authorization is not enforced, the plugin performs the requested operation and returns the associated data or applies the requested change. Refer to the Patchstack Vulnerability Report for the affected endpoint and technical specifics.

Detection Methods for CVE-2026-73348

Indicators of Compromise

Unexpected requests to GiveWP admin-ajax.php or REST routes such as /wp-json/give-api/ originating from unauthenticated sessions.
Modifications to donation records, campaign settings, or plugin configuration without a corresponding administrator login event.
HTTP 200 responses to plugin actions that would normally require authentication.

Detection Strategies

Inventory WordPress installations and identify hosts running GiveWP versions prior to 4.16.6.
Inspect web server access logs for anonymous POST or GET requests targeting GiveWP endpoints, especially those returning donation data.
Correlate WordPress audit logs with authentication events to identify plugin actions that occurred without a valid administrator session.

Monitoring Recommendations

Enable a WordPress activity logging plugin to record plugin-level actions and privilege usage.
Forward web server and WordPress logs to a centralized SIEM for correlation and long-term retention.
Alert on repeated anonymous access to plugin endpoints that should be gated behind authentication.

How to Mitigate CVE-2026-73348

Immediate Actions Required

Update the GiveWP plugin to version 4.16.6 or later on every WordPress site in your estate.
Audit donation records and plugin settings for unauthorized changes made prior to patching.
Rotate API keys, webhook secrets, and payment gateway credentials referenced by GiveWP if tampering is suspected.

Patch Information

The vendor has released GiveWP 4.16.6, which introduces the missing authorization checks. Site administrators should apply the update through the WordPress plugin manager or by deploying the patched plugin package. Details are available in the Patchstack Vulnerability Report.

Workarounds

Restrict access to WordPress admin-ajax.php and GiveWP REST routes at the web application firewall (WAF) until the patch is applied.
Temporarily deactivate the GiveWP plugin on sites that cannot be updated immediately.
Enforce IP allowlisting for administrative endpoints where operationally feasible.

bash

# Example: update GiveWP using WP-CLI
wp plugin update give --version=4.16.6
wp plugin list --name=give --fields=name,status,version