GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 - Unauthenticated Sensitive Information Exposure via Email Meta Tag Injection
- ID
- WPSEC-2026-0360
- Plugin
- GiveWP – Donation Plugin and Fundraising Platform (give)
- Affected
- all versions before 4.18.0
- Remediation
- Update to 4.18.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- GiveWP – Donation Plugin and Fundraising Platform on WPSec AttackSurface
- Fix released
- Published
Description
The GiveWP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.0. This is due to {meta_*} template tags being resolved after the other template tags had been substituted, so {meta_*} syntax supplied in a donor field such as the first name was expanded as well, and to the donor lookup falling back to any donors-table column, including the email-access token and verify_key. This makes it possible for unauthenticated attackers to make a donation with an existing donor's email address and have that donor's stored details, such as billing address, phone number and any pending email-access verify key (which grants access to the donor's donation history), displayed on the donation confirmation page.
References
- https://wpsec.com/vuln/WPSEC-2026-0360/
- https://plugins.svn.wordpress.org/give/tags/4.18.0/
- https://wordpress.org/plugins/give/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS