CVE-2026-42642

WordPress GiveWP plugin <= 4.14.5 - Broken Access Control vulnerability

Published Apr 29, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

Missing Authorization vulnerability in StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through <= 4.14.5.

Analysis

Technical impact

The defect is a missing authorization flaw (CWE‑862) in the StellarWP GiveWP plugin that permits bypassing configured access control rules. This flaw allows a user to access administrative functions that should normally be protected, potentially exposing or allowing manipulation of donation‑related features.

Affected Systems

WordPress installations that use the GiveWP plugin version 4.14.5 or earlier are affected. The issue applies to all releases of GiveWP managed by StellarWP up to and including version 4.14.5.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1 % reflects a very low probability of exploitation at the time of reporting, and the vulnerability is not listed in the CISA KEV catalog. The hypothetical attack vector is inferred to be a web‑based exploit that requires the attacker to send crafted HTTP requests to the plugin’s endpoints; no special network or local privileges are required to attempt the exploit.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

StellarWP

GiveWP

unaffected

Version	Status	Constraints
`0`	affected	≤ 4.14.5

No data.

Vendor Product Versions

Stellarwp

Givewp

Version	Status	Scheme	Platform
`[0,4.14.5]`	affected	semver	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the GiveWP plugin to a version newer than 4.14.5 to eliminate the access‑control flaw.
If an upgrade is not immediately possible, restrict the use of roles or capabilities that allow access to the plugin’s administrative views, ensuring that only trusted users have such privileges.
Enable logging and monitoring of administrative actions performed via the plugin so that any unauthorized activity can be detected and investigated.

Generated by OpenCVE AI on April 29, 2026 at 17:02 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.191% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/give/vulnerability/wordpress-givewp-plugin-4-14-5-broken-access-control-vulnerability?_s_id=cve

History

Apr 29, 2026 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 29, 2026 12:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Stellarwp Stellarwp givewp Wordpress Wordpress wordpress
Vendors & Products		Stellarwp Stellarwp givewp Wordpress Wordpress wordpress

Apr 29, 2026 11:30 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Missing Authorization vulnerability in StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through <= 4.14.5.
Title		WordPress GiveWP plugin <= 4.14.5 - Broken Access Control vulnerability
Weaknesses		CWE-862
References		https://patchstack.com/database/Wordpress/Plugin/give/vulnerability/wordpress-givewp-plugin-4-14-5-broken-access-control-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}`