CVE-2026-106600 in GiveWP Plugin
Summary
by MITRE • 10/08/2026
Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through 4.18.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The identified security flaw represents a critical failure in access control mechanisms within the GiveWP plugin, specifically affecting versions ranging from its initial release up to version 4.18.0 distributed by Liquid Web and StellarWP. This vulnerability is classified as an improper authorization issue where the application fails to enforce sufficient restrictions on authenticated users regarding what actions they can perform or which resources they can access. In the context of web applications, particularly those handling financial transactions like donation platforms, such a lapse allows attackers with valid credentials but insufficient privileges to bypass intended security boundaries and execute administrative functions or manipulate sensitive data that should be restricted to higher-privileged accounts.
From a technical perspective, this vulnerability stems from missing authorization checks in specific endpoints or API calls within the plugin's codebase. When an authenticated user attempts to perform an action that requires elevated permissions, such as modifying donation settings, accessing donor lists, or altering payment gateway configurations, the application does not adequately verify whether the current session possesses the necessary role-based access rights. This oversight means that any logged-in user, regardless of their assigned role in WordPress, can potentially interact with administrative features intended exclusively for administrators. The root cause lies in the absence of robust server-side validation logic to ensure that each request is authorized before processing sensitive operations, relying instead on client-side restrictions or missing checks entirely which are trivially bypassed by any attacker capable of crafting custom HTTP requests.
The operational impact of this vulnerability is severe due to the nature of GiveWP as a donation management tool. An exploited instance could lead to unauthorized modification of campaign settings, potentially redirecting funds to malicious accounts or disabling critical security features like two-factor authentication for admin users if such integrations exist. Furthermore, attackers with access to donor information could exfiltrate personally identifiable information including names, email addresses, and payment details, leading to significant privacy violations and potential regulatory non-compliance under standards such as GDPR or CCPA. The ability to alter plugin configurations also allows adversaries to inject malicious code into donation forms or disable logging mechanisms, thereby facilitating further attacks while evading detection. This directly compromises the confidentiality, integrity, and availability of the application's data and functionality.
In terms of industry standard classifications, this vulnerability aligns with CWE-269 which denotes Improper Privilege Management, specifically highlighting cases where an actor is granted privileges they should not have. It also maps to MITRE ATT&CK technique T1078 Valid Accounts, as the exploitation relies on using legitimate credentials that are then abused due to insufficient access control policies. The lack of proper authorization checks allows for privilege escalation from a low-privileged user account to an administrative level without requiring additional exploits or social engineering beyond initial authentication. This makes it particularly dangerous in environments where multiple users have varying levels of access, such as staff members managing donations who should not have full system administration rights.
To mitigate this risk, immediate action is required by upgrading the GiveWP plugin to a version later than 4.18.0 where these authorization checks have been properly implemented and validated by the developers. Organizations relying on older versions must apply temporary compensating controls such as restricting access to WordPress admin pages through IP whitelisting or network segmentation if possible, although this is less effective for cloud-based deployments. It is also crucial to enforce strict role-based access control policies within the WordPress environment itself, ensuring that users are assigned only the minimum privileges necessary for their roles. Regular security audits and penetration testing should be conducted to identify similar authorization flaws in other plugins or custom code, as these issues often indicate broader weaknesses in application design and implementation practices regarding identity and access management.