CVE-2026-82663
Deferred Deferred - Pending Action

Authorization Bypass in Give WordPress Plugin

Publication date: 2026-11-15

Last updated on: 2026-11-15

Assigner: Wordfence

Description
The Give - Peer-to-Peer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.9.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers who know or discover an existing campaign and team ID to modify the team's name, story, goal, access and notification settings, set its profile image URL, and upload WordPress-allowed media files as parentless attachments. This vulnerability can be combined with CVE-2026-82568 to achieve unauthenticated remote code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-15
Last Modified
2026-11-15
Generated
2026-11-15
AI Q&A
2026-11-15
EPSS Evaluated
N/A
NVD
CVE-2026-82663
EUVD
EUVD-2026-126007

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
GiveWP Give - Peer-to-Peer From 0 (inc) to 2.9.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Give - Peer-to-Peer WordPress plugin up to version 2.9.5 has an authorization bypass flaw. Unauthenticated attackers can exploit this by knowing or discovering a campaign and team ID to modify team settings, upload media files, and change configurations without proper verification.

Detection Guidance

This vulnerability allows unauthenticated attackers to modify team settings and upload files if they know a campaign and team ID. Check WordPress logs for unauthorized modifications to team names, stories, goals, or settings. Review uploaded media files for unexpected parentless attachments. Use commands like grep to search for suspicious activity in logs: grep -i 'givewp' /var/log/nginx/access.log or grep -i 'givewp' /var/log/apache2/access.log. Inspect WordPress upload directories for unfamiliar files.

Impact Analysis

Attackers could alter team names, goals, or settings, upload malicious files, or combine this with another vulnerability (CVE-2026-82568) to execute remote code on your WordPress site, potentially leading to full system compromise.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized modifications to team settings and media uploads. Unauthenticated attackers could alter team data, which may include sensitive information, and upload unauthorized files. This could lead to data integrity issues and unauthorized access, both of which are critical concerns under GDPR and HIPAA.

Mitigation Strategies

Update the Give - Peer-to-Peer plugin to the latest version beyond 2.9.5 immediately. Disable the plugin temporarily if an update is not available. Review user roles and permissions for unauthorized changes. Monitor for suspicious activity related to team or campaign modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82663. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...