Technical impact
The GiveWP plugin fails to enforce the currency of a donation against the one accepted by a site or form, and it compares donation amounts as raw numeric values. This flaw lets unauthenticated users submit donations in an unauthorized currency that is treated as a smaller value, allowing them to donate amounts below a form's configured minimum or fixed amount. The impact is primarily financial loss and potential denial of access to legitimate donation revenue streams, while maintaining an appearance of normal operation for site administrators. This issue stems from improper validation of monetary input and a failure to apply proper business logic constraints.
Affected Systems
WordPress installations using the GiveWP plugin version 4.19.0.1 or earlier are affected. The flaw applies to any form configured with a minimum donation or fixed amount that does not properly validate the currency of the incoming donation request.
Risk and Exploitability
The CVSS score of 5.3 indicates a medium severity risk. No EPSS data is available, so the current exploitation probability is unknown, and the vulnerability is not listed in CISA's KEV catalog. Attackers can exploit the vulnerability by crafting requests with an unauthorized currency, which bypasses server‑side checks without authentication. The lack of an authentication requirement lowers the barrier to exploit, and because the bypass relies solely on input manipulation, it can be performed by any user with internet access.
