CVE-2026-97196: GiveWP Authentication Bypass Vulnerability

CVE-2026-97196 Overview

CVE-2026-97196 is an authentication bypass vulnerability in the GiveWP WordPress plugin by Liquid Web / StellarWP. The flaw stems from improper validation of unsafe equivalence in input [CWE-1289], allowing unauthenticated attackers to bypass authentication controls over the network. The vulnerability affects GiveWP versions up to and including 4.16.9. GiveWP is a widely deployed donation and fundraising plugin used across nonprofit and charitable WordPress sites.

Critical Impact
An unauthenticated attacker can bypass authentication remotely with low complexity and no user interaction, leading to compromise of confidentiality and integrity.

Affected Products

Liquid Web / StellarWP GiveWP plugin for WordPress
All versions from n/a through 4.16.9
WordPress sites running GiveWP donation functionality

Discovery Timeline

2026-09-30 - CVE-2026-97196 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-97196

Vulnerability Analysis

The vulnerability is classified under CWE-1289: Improper Validation of Unsafe Equivalence in Input. The plugin compares user-supplied input against expected values using a comparison method that treats non-equivalent values as equivalent. This allows attackers to submit crafted input that passes authentication checks without valid credentials.

An attacker exploiting this weakness gains access to protected functionality reserved for authenticated users. The scope of impact covers both confidentiality and integrity, indicating access to sensitive donor data and the ability to modify plugin state or records.

Root Cause

The root cause is a comparison routine that fails to enforce strict equivalence between provided input and expected authentication tokens or identifiers. Loose comparison operators, type juggling, or normalization steps can cause distinct values to evaluate as equal. In PHP applications, this pattern often occurs when the == operator is used in place of === when validating hashes, tokens, or magic values.

Attack Vector

The attack originates over the network with no authentication and no user interaction required. An attacker sends a crafted HTTP request to a vulnerable GiveWP endpoint on a target WordPress site. The improper comparison logic accepts the malformed input as valid, granting the attacker access reserved for authenticated principals.

The vulnerability manifests in an authentication routine that fails to enforce strict equivalence. See the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2026-97196

Indicators of Compromise

Unexpected access to GiveWP administrative endpoints from unauthenticated sessions
Anomalous requests to donation management routes containing malformed authentication parameters
Creation or modification of donor records, forms, or payment gateways without corresponding admin login events
WordPress user or role changes correlated with GiveWP plugin activity

Detection Strategies

Inspect web server access logs for repeated POST or GET requests to GiveWP REST or admin-ajax endpoints from single source IPs
Correlate WordPress authentication logs with GiveWP privileged actions to identify actions performed without a preceding login
Deploy WAF rules to flag requests containing type-juggling payloads such as boolean or array values in fields expecting strings

Monitoring Recommendations

Enable WordPress audit logging for all GiveWP configuration and donation record changes
Monitor outbound traffic from the WordPress host for exfiltration of donor personal and payment metadata
Alert on new administrator or elevated-role account creation events on sites running GiveWP

How to Mitigate CVE-2026-97196

Immediate Actions Required

Identify all WordPress installations running GiveWP version 4.16.9 or earlier
Update GiveWP to the vendor-supplied patched release as soon as it is available
Review WordPress user accounts and donor records for signs of unauthorized modification
Rotate WordPress administrator credentials and any API keys stored within GiveWP

Patch Information

Refer to the Patchstack Vulnerability Report for the vendor-supplied fixed version. Apply the vendor patch through the WordPress plugin update mechanism once released by Liquid Web / StellarWP.

Workarounds

Restrict access to GiveWP endpoints using a web application firewall until patching is complete
Limit administrative endpoint access by source IP where operationally feasible
Temporarily deactivate the GiveWP plugin on sites that cannot be updated immediately

bash

# Configuration example
# Refer to vendor advisory for authoritative mitigation configuration