CVE-2026-73352: GiveWP Auth Bypass Vulnerability

CVE-2026-73352 Overview

CVE-2026-73352 is an unauthenticated broken access control vulnerability affecting the GiveWP WordPress donation plugin in versions up to and including 4.16.5.1. The flaw is categorized under [CWE-862] Missing Authorization. Remote attackers can reach protected functionality over the network without credentials or user interaction. Successful exploitation results in limited confidentiality and integrity impact on affected WordPress sites running the plugin.

Critical Impact
Unauthenticated attackers can invoke GiveWP plugin functionality that should require authorization, exposing donation-related data and enabling unauthorized state changes on affected WordPress installations.

Affected Products

GiveWP WordPress plugin versions <= 4.16.5.1
WordPress installations with the GiveWP donation plugin enabled
Any site relying on GiveWP for donation processing and donor data handling

Discovery Timeline

2026-08-18 - CVE-2026-73352 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73352

Vulnerability Analysis

The vulnerability is a Broken Access Control issue in the GiveWP WordPress plugin. GiveWP exposes plugin functionality without performing proper authorization checks on the caller. An unauthenticated remote attacker can reach these endpoints directly over HTTP or HTTPS. The issue maps to [CWE-862] Missing Authorization, indicating that a code path required a permission check that is absent or improperly implemented.

Because the plugin handles donation records, donor identifiers, and related transactional metadata, exposure of these endpoints creates risk of unauthorized data reads and limited unauthorized modifications. The current EPSS value indicates a low observed likelihood of exploitation in the near term, but the network-reachable, unauthenticated nature of the flaw makes internet-facing WordPress sites the primary risk population.

Root Cause

The root cause is a missing or insufficient authorization check on one or more GiveWP plugin request handlers. WordPress plugins are expected to gate privileged actions with current_user_can() capability checks and, where applicable, check_ajax_referer() or REST API permission_callback validation. In GiveWP versions <= 4.16.5.1, at least one such handler executes without confirming that the requesting principal is authorized.

Attack Vector

The attack vector is network-based and does not require authentication or user interaction. An attacker sends crafted HTTP requests directly to the vulnerable GiveWP endpoint, such as the WordPress admin-ajax.php action or a REST route registered by the plugin. Because no session, nonce, or capability check blocks the request, the server processes the action as though the caller were permitted. See the Patchstack Vulnerability Report for the specific endpoint disclosure.

Detection Methods for CVE-2026-73352

Indicators of Compromise

Unauthenticated HTTP requests to GiveWP-related endpoints under /wp-admin/admin-ajax.php or /wp-json/give-api/ originating from unfamiliar IPs.
Unexpected donation record reads, modifications, or exports that do not correspond to an authenticated administrator session.
Access log entries showing repeated requests to GiveWP action names without a corresponding wp-login.php authentication event.

Detection Strategies

Inventory all WordPress sites and confirm the installed GiveWP plugin version; flag any instance at or below 4.16.5.1.
Correlate web access logs with WordPress authentication logs to identify plugin actions invoked without a preceding login.
Deploy web application firewall rules that alert on GiveWP endpoint calls lacking a valid nonce parameter.

Monitoring Recommendations

Monitor wp-content/plugins/give/ for file changes and configuration writes outside maintenance windows.
Alert on outbound requests from the WordPress host that follow donation-data endpoint access, which may indicate exfiltration.
Track HTTP 200 responses on GiveWP AJAX and REST routes with no Cookie: wordpress_logged_in_* header present.

How to Mitigate CVE-2026-73352

Immediate Actions Required

Upgrade GiveWP to a version above 4.16.5.1 as soon as the vendor-supplied patched release is available.
Restrict access to wp-admin/admin-ajax.php and GiveWP REST routes at the WAF or reverse proxy where feasible.
Review donation records and donor exports for unauthorized access since the plugin was installed.

Patch Information

Refer to the Patchstack Vulnerability Report for the fixed version and vendor patch details. Apply the update through the WordPress plugin manager or by replacing the plugin directory with the patched release. Verify the plugin version reported under Plugins > Installed Plugins after upgrade.

Workarounds

Temporarily disable the GiveWP plugin on sites that cannot be patched immediately, pausing donation intake if necessary.
Add WAF rules that block unauthenticated requests to GiveWP AJAX actions and REST namespaces until the patch is deployed.
Rotate WordPress administrator credentials and API keys if log review indicates suspicious plugin endpoint activity.

bash

# Configuration example: identify vulnerable GiveWP versions using WP-CLI
wp plugin get give --field=version
wp plugin update give