{
 "id": "WPSEC-2026-1737",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1737/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1737/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1737/index.md",
 "title": "GiveWP <= 4.19.0.1 - Unauthenticated Authentication Bypass to Guest Donor Record Takeover via Donation Form Registration",
 "description": "The GiveWP plugin for WordPress is vulnerable to Authentication Bypass via the account registration option on donation forms in all versions up to, and including, 4.19.0.1. This is due to give_donation_form_validate_new_user() not validating the submitted email as a new user registration, and to give_validate_user_email() rejecting only emails that are stored as a donor's additional email. As a result, a new WordPress account could be created with the primary email of an existing guest donor, and give_connect_donor_to_wpuser() then linked that donor record to the new account. This makes it possible for unauthenticated attackers who know the email address of a donor without a linked WordPress account to register with that address, take over the donor record, and view the donor's donation history, receipts and profile information.",
 "plugin": {
  "slug": "give",
  "name": "GiveWP",
  "full_name": "GiveWP – Donation Plugin and Fundraising Platform",
  "wordpress_org": "https://wordpress.org/plugins/give/",
  "advisories_url": "https://wpsec.com/vuln/plugin/give/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/give"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-287"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.19.0.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.19.0.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.19.0.2",
 "remediation": "Update to 4.19.0.2 or later.",
 "fix_released": "2026-10-26T13:07:49+00:00",
 "published": "2026-10-27T13:53:32+00:00",
 "updated": "2026-10-27T13:38:27.467590+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1737/",
  "https://plugins.svn.wordpress.org/give/tags/4.19.0.2/",
  "https://wordpress.org/plugins/give/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/give",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-27"
 }
}