Technical impact
The vulnerability arises because the GiveWP WordPress plugin prior to version 4.19.0.1 does not properly validate a user‑supplied filename during the core settings import process. This oversight allows an attacker who possesses a high‑privilege custom role to perform path traversal, read arbitrary JSON‑parseable files located anywhere on the server, and overwrite the plugin’s stored configuration. Consequently, the attacker can potentially inject malicious configuration data, leading to unauthorized code execution or privilege escalation on the affected WordPress installation.
Affected Systems
All WordPress sites running GiveWP versions earlier than 4.19.0.1 are affected, provided the attacker has access to a custom role with sufficient privileges to initiate a core settings import.
Risk and Exploitability
Because the vulnerability relies on a high‑privilege role, the attack surface is limited to trusted users but, if compromised, the path traversal mechanism offers broad file read and write capabilities. The EPSS score is <1% and the vulnerability is not in KEV, yet the CVSS score of 6.0 indicates medium severity. Combined with the ability to overwrite the plugin’s stored configuration and potentially execute code, the risk remains significant. The likely attack path involves an authenticated user uploading a crafted file name during the core settings import function.
