The GiveWP WordPress plugin, when installed in versions earlier than 4.16.3, fails to enforce the administrator‑defined list of active payment gateways. Instead, it derives part of the gateway selection from user input, allowing an unauthenticated user to specify and process a donation using any payment gateway, even those disabled. This flaw can lead to unauthorized monetary transfers, confusion over campaign funding, and potential loss of trust in the site’s donation system.

Any website running the GiveWP plugin for WordPress prior to version 4.16.3 is vulnerable. Administrators using the default plugin configuration, which typically includes disabling certain gateways, will unknowingly expose the site to this bypass. No additional vendor or product details are available; the issue is tied solely to the GiveWP plugin itself.

The exploit does not require privileged access or prior knowledge of credentials; it simply involves crafting a request to the donation completion endpoint with a gateway value that the site has disabled. Because the vulnerability is tied to user input, it can be triggered by anyone who can submit donation forms. While the CVSS score is 5.3, the ability to conduct unauthorized financial transactions renders the threat significant. The EPSS score is < 1%, and there is no indication of exploitation in public feeds (KEV status lists it as not in the catalog). Nonetheless, the straightforward attack vector and potential impact warrant prompt remediation.