CVE-2026-104405 in GiveWP Plugin
Summary
by MITRE • 10/06/2026
Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified as an unauthenticated privilege escalation within GiveWP, specifically affecting versions up to and including 4.17.0, represents a critical security flaw that allows attackers to gain administrative access without valid credentials. This type of vulnerability is particularly severe because it bypasses the fundamental authentication mechanisms designed to protect web applications from unauthorized users. The core issue stems from insufficient validation or sanitization of user-supplied input in specific endpoints or functions within the GiveWP plugin, which is a widely used donation management platform for WordPress sites. When an attacker interacts with these vulnerable components, they can manipulate internal logic to escalate their privileges from a standard visitor role to that of an administrator, thereby gaining full control over the underlying website and its data.
From a technical perspective, this flaw typically involves improper access controls or insecure direct object references where the application fails to verify whether the requesting user has the necessary permissions for the action being performed. In many cases involving WordPress plugins, such vulnerabilities arise when functions that modify critical settings, create new users with elevated roles, or alter database records do not properly check the current user's capabilities before executing state-changing operations. The attacker can craft specific HTTP requests containing malicious parameters that exploit these logic gaps. By sending these crafted requests to vulnerable endpoints, often via POST methods or AJAX calls intended for legitimate administrative tasks but accessible without authentication due to misconfigured nonce validation or missing capability checks, the system erroneously processes the request as if it originated from an authenticated administrator. This allows the injection of malicious code, creation of backdoor accounts, or modification of site configurations that compromise integrity and confidentiality.
The operational impact of this vulnerability is profound for organizations relying on GiveWP to manage donations and donor information. Once an attacker achieves administrative privileges through unauthenticated escalation, they can exfiltrate sensitive donor data including names, email addresses, payment details, and donation histories, leading to significant privacy violations and potential regulatory non-compliance with standards such as GDPR or PCI DSS if financial data is involved. Furthermore, the compromised site becomes a vector for further attacks, allowing the insertion of malware, phishing pages, or defacement scripts that can harm visitors and damage the organization's reputation. Search engines may blacklist the domain due to malicious content injection, resulting in loss of traffic and revenue. The ability to execute arbitrary code at an administrative level also means attackers can install persistent backdoors, ensuring continued access even if initial vulnerabilities are patched later without thorough forensic cleanup.
This vulnerability aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization in the Common Weakness Enumeration database, highlighting failures in enforcing least privilege principles and verifying user permissions respectively. In terms of offensive security frameworks, this behavior corresponds to MITRE ATT&CK technique T1078 Valid Accounts, specifically involving unauthorized access or misuse of legitimate credentials through exploitation rather than theft, often categorized under Initial Access or Persistence depending on the attacker's subsequent actions. The lack of proper input validation and authorization checks places it squarely within the realm of broken access control vulnerabilities which are consistently among the most critical risks in web application security as defined by OWASP Top 10 lists.
Mitigation strategies must prioritize immediate remediation through updating GiveWP to version 4.17.1 or later, where these privilege escalation flaws have been addressed with stricter input validation and robust authorization checks. Administrators should ensure that all WordPress core files and associated plugins are kept up-to-date to benefit from ongoing security patches. Implementing a Web Application Firewall can provide an additional layer of defense by blocking known exploit patterns associated with unauthenticated access attempts, although this is not a substitute for patching the underlying code. Regular security audits using static application security testing tools focused on PHP and WordPress-specific coding standards can help identify similar logic flaws before they are exploited in production environments. Additionally, enforcing strong authentication policies such as multi-factor authentication adds resilience against credential-based attacks that might complement privilege escalation attempts.