# GiveWP <= 4.19.0 - Unauthenticated Donation Currency Restriction Bypass

- **ID:** WPSEC-2026-1540
- **Plugin:** GiveWP – Donation Plugin and Fundraising Platform (`give`), https://wordpress.org/plugins/give/
- **Affected versions:** from 3.0.0 before 4.19.0.1
- **Fixed in:** 4.19.0.1 (Update to 4.19.0.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-20
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-23)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/give
- **Fix released:** 2026-10-22
- **Published:** 2026-10-23
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1540/

## Description

The GiveWP plugin for WordPress is vulnerable to a currency restriction bypass via the currency field of donation forms built with the visual form builder in versions 3.0.0 up to, and including, 4.19.0, due to the submitted currency being checked only against every currency GiveWP supports rather than the currencies the donation form accepts. This makes it possible for unauthenticated attackers to record donations in currencies the form does not accept, which distorts the recorded donation amounts.

## References

- https://wpsec.com/vuln/WPSEC-2026-1540/
- https://plugins.svn.wordpress.org/give/tags/4.19.0.1/
- https://wordpress.org/plugins/give/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1540/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.