Vulnerabilities / GiveWP / WPSEC-2026-1540
GiveWP <= 4.19.0 - Unauthenticated Donation Currency Restriction Bypass
Medium 5.3
CWE-20Fixed in 4.19.0.1
- ID
- WPSEC-2026-1540
- Plugin
- GiveWP – Donation Plugin and Fundraising Platform (give)
- Affected
- from 3.0.0 before 4.19.0.1
- Remediation
- Update to 4.19.0.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-20
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-23
- Attack surface
- GiveWP on WPSec AttackSurface
- Fix released
- Published
Description
The GiveWP plugin for WordPress is vulnerable to a currency restriction bypass via the currency field of donation forms built with the visual form builder in versions 3.0.0 up to, and including, 4.19.0, due to the submitted currency being checked only against every currency GiveWP supports rather than the currencies the donation form accepts. This makes it possible for unauthenticated attackers to record donations in currencies the form does not accept, which distorts the recorded donation amounts.
References
- https://wpsec.com/vuln/WPSEC-2026-1540/
- https://plugins.svn.wordpress.org/give/tags/4.19.0.1/
- https://wordpress.org/plugins/give/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS