What’s Vulnerable › Vulnerabilities
CVE-2026-85530: GiveWP < 4.16.8.1 - Unauthenticated Account Takeover via Donor Email Sanitization Mismatch
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-16 · updated 2026-09-17
- Weakness: CWE-269
Description
The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user account linked to one, including an administrator's.
Affected products
- stellarwp GiveWP – Donation Plugin and Fundraising Platform: from 4.16.6 before 4.16.8.1 — fixed in 4.16.8.1
How to fix
Upgrade to a fixed version: stellarwp GiveWP – Donation Plugin and Fundraising Platform 4.16.8.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-85530 or the next vulnerability affects your stack