The vulnerability allows an unauthenticated attacker to elevate privileges within the WordPress site by exploiting the GiveWP plugin version 4.17.0 or earlier. An attacker can gain higher access rights beyond their original role, potentially enabling modification of plugin settings, donation configurations, or other administrative functions. This is a classic privilege escalation flaw identified as CWE-266.

The affected product is the GiveWP WordPress plugin supplied by Nexcess. All installations of GiveWP version 4.17.0 or older are vulnerable. The vulnerability description does not list additional affected versions beyond 4.17.0, so only those releases are at risk until the plugin is updated.

The CVSS score of 8.1 indicates a high severity, and the EPSS score of <1% indicates a very low but nonzero exploitation probability; the lack of an authentication requirement suggests that any visitor to the site could exploit the flaw. The vulnerability is not listed in the CISA KEV catalog, so there is no known exploit in the wild yet, but the absence of authentication makes exploitation feasible. The attacker would need only access to the site’s front‑end or any exposed API endpoints tied to the GiveWP plugin. Once privilege is escalated, the scope extends to the entire WordPress installation, allowing full control of the site’s content and configuration.