CVE-2026-85530: GiveWP WordPress Plugin Auth Bypass Vulnerability

CVE-2026-85530 Overview

CVE-2026-85530 affects the GiveWP donation plugin for WordPress in versions prior to 4.16.8.1. The plugin fails to consistently normalise a donor's email address between the value it stores and the value it later uses to look that donor up. Unauthenticated attackers can exploit this inconsistency to be resolved as an arbitrary donor. The flaw then allows them to set the WordPress password of any user account linked to that donor, including administrator accounts. This maps to CWE-269: Improper Privilege Management and results in full site takeover.

Critical Impact
Unauthenticated attackers can hijack administrator accounts on WordPress sites running vulnerable GiveWP installations, leading to full site compromise.

Affected Products

GiveWP WordPress plugin versions prior to 4.16.8.1
WordPress installations with GiveWP donation forms exposed to unauthenticated users
Any WordPress user account whose email matches a donor record, including administrators

Discovery Timeline

2026-09-16 - CVE-2026-85530 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-85530

Vulnerability Analysis

The vulnerability stems from inconsistent email address normalisation inside GiveWP's donor lookup logic. When the plugin stores a donor's email, it applies one normalisation path. When it later resolves a donor from a user-supplied email, it applies a different path. This mismatch means two distinct string values can point to the same donor record on write but resolve differently on read, or vice versa. An attacker submits an email variant that GiveWP treats as belonging to a target donor while WordPress treats the linked account as the attacker's session context.

Once the plugin resolves the attacker as an arbitrary donor, it exposes account management functionality tied to that donor. This includes the ability to set the WordPress password of the linked user account. When the linked account is an administrator, the attacker gains full control of the WordPress site without any prior authentication.

Root Cause

The root cause is improper privilege management [CWE-269] driven by inconsistent input canonicalisation. Email addresses can differ by case, whitespace, or Unicode encoding while still representing the same logical identity. GiveWP's storage and lookup routines do not apply the same canonical form, breaking the trust boundary between donor identity and WordPress user identity.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker crafts an email string that collides with an administrator's donor record under GiveWP's lookup normalisation. The attacker submits this value to the donor-facing password reset or account management endpoint exposed by GiveWP. GiveWP resolves the request as the target donor and permits the attacker to set a new WordPress password for the linked administrator account.

No verified proof-of-concept code has been published. See the WPScan Vulnerability Analysis for additional technical detail.

Detection Methods for CVE-2026-85530

Indicators of Compromise

Unexpected password change events for WordPress administrator or editor accounts with no corresponding legitimate reset request.
GiveWP donor lookup or account management requests originating from unauthenticated sessions and targeting emails that match privileged users.
New administrator logins from previously unseen IP addresses or user agents shortly after GiveWP endpoint activity.
Modifications to WordPress wp_users records, plugin/theme files, or scheduled tasks following donor-related HTTP requests.

Detection Strategies

Inspect web server access logs for POST requests to GiveWP donor and account endpoints containing email variants such as mixed case, trailing whitespace, or Unicode homoglyphs.
Correlate GiveWP request activity with WordPress password_reset and user_register audit events to identify unauthenticated actors driving privileged changes.
Deploy WAF rules that flag repeated donor lookups with near-identical email strings that differ only in normalisation-sensitive characters.

Monitoring Recommendations

Enable WordPress audit logging for all user password changes, role changes, and profile updates, and forward events to a central SIEM or data lake.
Monitor administrator account authentication events for anomalous source IPs, geolocations, and session times.
Alert on any GiveWP plugin errors or debug entries referencing donor-to-user resolution during the exposure window.

How to Mitigate CVE-2026-85530

Immediate Actions Required

Upgrade GiveWP to version 4.16.8.1 or later on every WordPress site running the plugin.
Force a password reset for all WordPress administrator and editor accounts whose email addresses appear in the GiveWP donor database.
Review WordPress user and role changes made during the exposure window and revert unauthorised modifications.
Rotate WordPress secret keys in wp-config.php to invalidate any sessions established by an attacker.

Patch Information

The GiveWP maintainers addressed the vulnerability in version 4.16.8.1 by aligning donor email normalisation across storage and lookup paths. Site administrators should apply the update through the WordPress plugin manager or by deploying the patched release manually. Refer to the WPScan Vulnerability Analysis for advisory details.

Workarounds

If immediate patching is not possible, deactivate the GiveWP plugin until the update can be applied.
Restrict access to GiveWP donor and account endpoints at the web server or WAF layer to trusted networks only.
Enforce multi-factor authentication for all WordPress administrator accounts to reduce the impact of a forced password reset.
Ensure administrator email addresses are not reused as donor email addresses on the same site.

bash

# Configuration example: block unauthenticated access to GiveWP donor endpoints via nginx
location ~* /wp-json/give-api/ {
    allow 10.0.0.0/8;
    deny all;
}

# Force WordPress salt rotation after suspected compromise
wp config shuffle-salts