WordPress GiveWP plugin versions up to and including 4.19.0.1 contain a broken access control flaw that allows an unauthenticated attacker to interact with protected endpoints. Based on the vulnerability description, it is inferred that the plugin handles sensitive data, and the broken access control may enable unauthorized reading or modification of that data, potentially leading to data exposure or manipulation.

The vulnerability affects the GiveWP WordPress plugin, as provided by Nexcess, and applies to all installations running version 4.19.0.1 or earlier. No other vendors or product versions are listed as impacted.

The CVSS score of 6.5 indicates medium severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV, so the observed exploitation likelihood is uncertain. The likely attack vector is a web‑based request to a protected admin route without authentication. Since the flaw is unauthenticated, an attacker with internet access to the site could exploit it using simple HTTP requests.