GiveWP – Donation Plugin and Fundraising Platform <= 4.19.1 - Authenticated (Subscriber+) Insecure Direct Object Reference via Donation Form Email
- ID
- WPSEC-2026-2516
- Plugin
- GiveWP – Donation Plugin and Fundraising Platform (give)
- Affected
- all versions before 4.19.1.1
- Remediation
- Update to 4.19.1.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-04
- Attack surface
- GiveWP – Donation Plugin and Fundraising Platform on WPSec AttackSurface
- Fix released
- Published
Description
The GiveWP plugin for WordPress is vulnerable to Insecure Direct Object Reference via the donor email field on donation forms in all versions up to, and including, 4.19.1. This is due to the plugin allowing logged-in users to submit a donation with any email address not already owned by another donor and automatically appending that address to their own donor record's additional emails. This makes it possible for authenticated attackers with subscriber-level access and above to claim email addresses belonging to other people, causing later donations made with that email to be associated with the attacker's donor record and potentially exposing related donation history or receipts.
References
- https://wpsec.com/vuln/WPSEC-2026-2516/
- https://plugins.svn.wordpress.org/give/tags/4.19.1.1/
- https://wordpress.org/plugins/give/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS