{
 "id": "WPSEC-2026-1738",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1738/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1738/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1738/index.md",
 "title": "GiveWP <= 4.19.0.1 - Unauthenticated Minimum and Fixed Donation Amount Bypass",
 "description": "The GiveWP plugin for WordPress is vulnerable to a donation amount restriction bypass via the amount field of donation forms built with the visual form builder in versions 3.0.0 up to, and including, 4.19.0.1. This is due to the Min and Size amount rules checking a plain PHP numeric cast of the submitted value, while the donation is created by parsing the same string with the Money decimal parser, which reads some numeric strings differently. For example, a value with a leading zero passes the check as the full amount but is stored and charged as a fraction of it. This makes it possible for unauthenticated attackers to make donations below the minimum amount or the fixed amount configured on a form.",
 "plugin": {
  "slug": "give",
  "name": "GiveWP",
  "full_name": "GiveWP – Donation Plugin and Fundraising Platform",
  "wordpress_org": "https://wordpress.org/plugins/give/",
  "advisories_url": "https://wpsec.com/vuln/plugin/give/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/give"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-20"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.0.0",
    "from_inclusive": true,
    "to": "4.19.0.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.0.0 before 4.19.0.2"
  ]
 },
 "introduced_in": "3.0.0",
 "fixed_in": "4.19.0.2",
 "remediation": "Update to 4.19.0.2 or later.",
 "fix_released": "2026-10-26T13:07:49+00:00",
 "published": "2026-10-27T13:53:32+00:00",
 "updated": "2026-10-27T13:38:27.467590+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1738/",
  "https://plugins.svn.wordpress.org/give/tags/4.19.0.2/",
  "https://wordpress.org/plugins/give/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/give",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-27"
 }
}