WordPress Plugin Vulnerabilities
GiveWP < 4.19.0.1 - Unauthenticated Donation Amount Restriction Bypass via Currency
Description
The plugin does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount limits as bare numbers, allowing unauthenticated users to make donations below a form's configured minimum or fixed amount.
Proof of Concept
Affects Plugins
Fixed in 4.19.0.1 References
CVE
Miscellaneous
Original Researcher
Shirshak
Submitter
Shirshak
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-10-23 (about 3 days ago)
Added
2026-10-23 (about 2 days ago)
Last Updated
2026-10-23 (about 2 days ago)
