GiveWP plugin for WordPress contains an unauthenticated Cross Site Request Forgery flaw that allows an attacker to submit forged HTTP requests to the plugin's endpoints without authentication. The flaw permits the attacker to invoke actions normally restricted to logged‑in users, potentially enabling manipulation of donation records, payment processing, or other state‑changing operations typical of the plugin. Based on the description, it is inferred that an attacker could alter donation data or trigger payments, as these are common privileged actions within GiveWP. The weakness is a classic CSRF flaw, identified as CWE‑352.

The Nexcess:GiveWP plugin, versions 4.16.3 and prior, is affected. Any WordPress site that includes the plugin is at risk until the plugin is upgraded to 4.16.4 or later.

The CVSS score of 5.4 represents a medium‑risk vulnerability, while the EPSS score of less than 1 % indicates a very low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, and no public exploit is known. Attackers can potentially trigger the exploit by luring a logged‑in WordPress user to a crafted external link that submits a forged request to the plugin’s endpoint. The flaw is unauthenticated, requiring no credentials to launch, but the victim must be authenticated to the target site to allow the state‑changing action to succeed.