{
 "id": "WPSEC-2026-1540",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1540/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1540/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1540/index.md",
 "title": "GiveWP <= 4.19.0 - Unauthenticated Donation Currency Restriction Bypass",
 "description": "The GiveWP plugin for WordPress is vulnerable to a currency restriction bypass via the currency field of donation forms built with the visual form builder in versions 3.0.0 up to, and including, 4.19.0, due to the submitted currency being checked only against every currency GiveWP supports rather than the currencies the donation form accepts. This makes it possible for unauthenticated attackers to record donations in currencies the form does not accept, which distorts the recorded donation amounts.",
 "plugin": {
  "slug": "give",
  "name": "GiveWP",
  "full_name": "GiveWP – Donation Plugin and Fundraising Platform",
  "wordpress_org": "https://wordpress.org/plugins/give/",
  "advisories_url": "https://wpsec.com/vuln/plugin/give/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/give"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-20"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.0.0",
    "from_inclusive": true,
    "to": "4.19.0.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.0.0 before 4.19.0.1"
  ]
 },
 "introduced_in": "3.0.0",
 "fixed_in": "4.19.0.1",
 "remediation": "Update to 4.19.0.1 or later.",
 "fix_released": "2026-10-22T16:29:51+00:00",
 "published": "2026-10-23T16:44:59+00:00",
 "updated": "2026-10-23T09:48:24.618621+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1540/",
  "https://plugins.svn.wordpress.org/give/tags/4.19.0.1/",
  "https://wordpress.org/plugins/give/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/give",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-23"
 }
}