The vulnerability is a Cross‑Site Request Forgery (CSRF) flaw, classified as CWE‑352, that allows an attacker to send unauthorized requests to the GiveWP plugin from a victim’s browser that holds a valid authentication token. Because the forgery relies only on the user’s session cookie, no direct access to the site or code execution is needed, but it can result in unintended actions performed by the plugin.

All releases of the StellarWP GiveWP plugin for WordPress, from the first available version through 4.13.1, are affected by the CSRF flaw.

The CVSS score of 5.4 indicates moderate risk, while the EPSS score of less than 1% reflects a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, and an attacker must lure a logged‑in user to a crafted link to exploit the flaw; no remote code execution or privileged escalation is required.