GiveWP <= 4.19.0.1 - Unauthenticated Minimum and Fixed Donation Amount Bypass
- ID
- WPSEC-2026-1738
- Plugin
- GiveWP – Donation Plugin and Fundraising Platform (give)
- Affected
- from 3.0.0 before 4.19.0.2
- Remediation
- Update to 4.19.0.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-20
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-27
- Attack surface
- GiveWP on WPSec AttackSurface
- Fix released
- Published
Description
The GiveWP plugin for WordPress is vulnerable to a donation amount restriction bypass via the amount field of donation forms built with the visual form builder in versions 3.0.0 up to, and including, 4.19.0.1. This is due to the Min and Size amount rules checking a plain PHP numeric cast of the submitted value, while the donation is created by parsing the same string with the Money decimal parser, which reads some numeric strings differently. For example, a value with a leading zero passes the check as the full amount but is stored and charged as a fraction of it. This makes it possible for unauthenticated attackers to make donations below the minimum amount or the fixed amount configured on a form.
References
- https://wpsec.com/vuln/WPSEC-2026-1738/
- https://plugins.svn.wordpress.org/give/tags/4.19.0.2/
- https://wordpress.org/plugins/give/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS