CVE-2026-14319
Received Received - Intake

Unauthenticated Access to Recurring Donor Data in GiveWP

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: WPScan

Description
The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to retrieve information about anonymous recurring donors, including their name and subscription details.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-14319
EUVD
EUVD-2026-51408

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
givewp givewp to 4.16.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the GiveWP WordPress plugin before version 4.16.3. It allows unauthenticated users to access a REST API endpoint that exposes recurring-donation records. The exposed data includes names and subscription details of anonymous recurring donors.

Detection Guidance

Check if the GiveWP plugin version is below 4.16.3 by inspecting the plugin files or WordPress admin panel. Look for unauthorized access to the REST API endpoint /wp-json/givewp/v1/recurring-donations. Use tools like curl to query the endpoint: curl -X GET http://yoursite.com/wp-json/givewp/v1/recurring-donations

Impact Analysis

If you use the affected GiveWP plugin, attackers could retrieve sensitive donor information without authentication. This may lead to privacy breaches, loss of donor trust, and potential misuse of personal data.

Compliance Impact

This vulnerability likely violates GDPR and other privacy regulations by exposing personal data without consent. It could result in legal penalties, fines, and reputational damage for organizations handling donor information.

Mitigation Strategies

Update the GiveWP plugin to version 4.16.3 or later immediately. If updating is not possible, disable the plugin temporarily or restrict access to the vulnerable endpoint via server rules or a firewall.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14319. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart