Is CVE-2026-97196 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-97196 being exploited in the wild.

How severe is CVE-2026-97196?

Critical severity, with a CVSS score of 9.1, published 30 September 2026.

Which products and versions are affected?

StellarWP GiveWP through 4.16.9.

Is there a fix for CVE-2026-97196?

A patch was published on 2026-09-24: Patch released in version 4.17.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-97196 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-97196?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97196: StellarWP GiveWP authentication bypass in login validation

CVE-2026-97196 · Severity: critical · CVSS 9.1 · Published 2026-09-30

GiveWP is a WordPress plugin for managing charitable donations and fundraising. A flaw in the plugin's login validation allows attackers to bypass authentication and gain access to user accounts without valid credentials, potentially exposing donor information and enabling account takeover.

Quick answers

Is CVE-2026-97196 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-97196 being exploited in the wild.
How severe is CVE-2026-97196?: Critical severity, with a CVSS score of 9.1, published 30 September 2026.
Which products and versions are affected?: StellarWP GiveWP through 4.16.9.
Is there a fix for CVE-2026-97196?: A patch was published on 2026-09-24: Patch released in version 4.17.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-97196 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-97196?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper validation of input equivalence in GiveWP's authentication mechanism allows unauthenticated attackers to bypass login checks and authenticate as arbitrary users. The vulnerability affects versions through 4.16.9 and is exploitable remotely with no special privileges or user interaction required. A patch is available in version 4.17.0.

Affected products

StellarWP GiveWP through 4.16.9

Timeline

2026-09-30: disclosed: Published to NVD
2026-09-24: patched: Patch released in version 4.17.0
2026-08-10: other: Vulnerability reported by Abdelrhman Allam

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.