Executive brief
GiveWP is a popular WordPress plugin used by organizations to accept donations. A security flaw allows unauthenticated users to bypass payment gateway restrictions set by administrators. This means a donor could potentially complete a transaction using a payment method that the organization has intentionally disabled or does not support, which could lead to accounting discrepancies or the processing of donations through unverified channels.
Technical details
The GiveWP plugin fails to properly validate the set of available payment gateways against the administrator's configuration. The vulnerability exists because the plugin derives the list of allowed gateways, in part, from user-supplied request input during the donation process. An unauthenticated attacker can exploit this by including specific parameters (e.g., 'gateways[manual]=1') in a POST request to the 'give_process_donation' action. This allows the attacker to successfully complete a donation using a gateway (such as the 'manual' or 'offline' gateway) even if it has been explicitly disabled in the plugin settings. The issue is fixed in version 4.16.3.
Affected products
- GiveWP GiveWP < 4.16.3
Timeline
- 2026-07-13: disclosed: Publicly published by WPScan
- 2026-07-31: advisory: CVE published to NVD