CVE-2026-96333: GiveWP Authentication Bypass Vulnerability

CVE-2026-96333 Overview

CVE-2026-96333 is an Authentication Bypass by Spoofing vulnerability [CWE-290] in the GiveWP donation plugin for WordPress, developed by Liquid Web / StellarWP. The flaw affects all GiveWP versions from the initial release through 4.16.8.1 and enables Identity Spoofing against payment workflows. An unauthenticated attacker can abuse the weakness remotely over the network without user interaction. Patchstack classifies the issue as a payment bypass, meaning donation or transaction records can be manipulated without legitimate authentication.

Critical Impact

Remote, unauthenticated attackers can spoof identity verification in GiveWP to bypass payment integrity checks, corrupting donation records on affected WordPress sites.

Affected Products

• Liquid Web / StellarWP GiveWP (give plugin) for WordPress
• All versions from initial release through 4.16.8.1
• WordPress sites running GiveWP for online donation processing

Discovery Timeline

• 2026-10-09 - CVE-2026-96333 published to the National Vulnerability Database (NVD)
• 2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-96333

Vulnerability Analysis

The vulnerability resides in the GiveWP plugin's payment handling logic. GiveWP fails to properly authenticate the identity of the entity submitting payment-related requests. This allows an attacker to spoof identity attributes and have the plugin treat forged requests as legitimate transactions. The result is a payment bypass that undermines the integrity of donation data stored in WordPress. Because the attack vector is network-based and requires no privileges or user interaction, exploitation can be fully automated against exposed sites.

Root Cause

The root cause is classified under CWE-290: Authentication Bypass by Spoofing. GiveWP relies on identity signals that an attacker can forge or replay, rather than validating a cryptographically bound credential or server-verified session. This design flaw permits identity spoofing throughout the affected release line up to and including 4.16.8.1. The Patchstack advisory describes the resulting condition as a payment bypass vulnerability.

Attack Vector

Exploitation occurs over the network against the public-facing WordPress site. An attacker crafts HTTP requests targeting GiveWP payment endpoints while supplying spoofed identity data that the plugin accepts without strong verification. No authentication, elevated privileges, or victim interaction is required. The impact centers on integrity: donation and payment records can be altered or injected. Confidentiality and availability are not directly affected, consistent with the published CVSS vector.

The vulnerability manifests in GiveWP's payment identity validation logic. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-96333

Indicators of Compromise

• Donation records in GiveWP marked as completed without corresponding payment gateway confirmations.
• Unexpected HTTP POST requests to GiveWP payment or donation processing endpoints originating from unfamiliar IP addresses.
• Anomalous entries in the wp_give_donations or related custom tables lacking matching gateway transaction identifiers.
• Spikes in low-value or zero-value donation submissions that complete without external gateway interaction.

Detection Strategies

• Correlate WordPress application logs with upstream payment gateway logs to flag completed donations that have no matching gateway transaction.
• Inspect web server access logs for repeated requests to GiveWP AJAX actions and REST routes from a narrow set of sources.
• Monitor plugin version inventory to identify WordPress sites still running GiveWP 4.16.8.1 or earlier.

Monitoring Recommendations

• Enable WordPress audit logging to capture donation state transitions and administrative changes to GiveWP settings.
• Forward WordPress, web server, and payment gateway logs into a centralized SIEM for cross-source correlation.
• Set alerts on sudden increases in failed signature verifications or malformed donation submission payloads.

How to Mitigate CVE-2026-96333

Immediate Actions Required

• Inventory all WordPress sites and identify instances running the GiveWP (give) plugin at version 4.16.8.1 or earlier.
• Upgrade GiveWP to the vendor-provided fixed release as soon as it is available via the WordPress plugin repository.
• Review recent donation and transaction records against payment gateway reports to detect spoofed entries.
• Rotate any API keys or webhook secrets associated with the GiveWP payment integrations.

Patch Information

The vulnerability affects GiveWP versions through 4.16.8.1. Administrators should consult the Patchstack Vulnerability Report and the GiveWP plugin page on WordPress.org for the fixed version and release notes. Apply the patched release across all WordPress environments, including staging and disaster recovery copies.

Workarounds

• Restrict access to GiveWP donation endpoints with a Web Application Firewall rule until the plugin is updated.
• Temporarily disable the GiveWP plugin on sites where immediate patching is not feasible and donations can be paused.
• Enforce server-side verification of payment gateway webhooks before marking donations as completed.

# Example WP-CLI commands to inventory and update the plugin
wp plugin get give --field=version
wp plugin update give