Executive brief
GiveWP is a popular WordPress plugin for managing charitable donations. The plugin fails to consistently normalize email addresses when storing and retrieving donor information, allowing attackers to impersonate any donor account—including those linked to administrators—and reset their passwords without authentication.
Technical details
The vulnerability is an authentication bypass caused by inconsistent email normalization between storage and lookup operations. When a donor's email is stored, it is normalized in one way, but when the plugin later uses the email to retrieve that donor's account, it applies different normalization rules. This mismatch allows an unauthenticated attacker to craft an email variant that matches a victim's account in the database, then reset the associated WordPress user password. The attack requires no authentication or user interaction. Patches are available in GiveWP 4.16.8.1 and later.
Affected products
- GiveWP GiveWP before 4.16.8.1
Timeline
- 2026-09-14: disclosed
- 2026-09-16: patched: Fixed in version 4.16.8.1