CVE-2026-14317: The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, wh
The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations through a payment gateway the administrator has disabled.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-14317
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-143170.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 13% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-14317 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for GiveWP WordPress plugin
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- highCVE-2026-14319: The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endp…nvd · 2026-07-31
- mediumCVE-2026-14318: The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting bef…nvd · 2026-07-30
- mediumCVE-2026-14987: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to St…nvd · 2026-07-16
- mediumCVE-2026-13704: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to St…nvd · 2026-07-02
- mediumCVE-2026-13246: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to St…nvd · 2026-07-01
- mediumCVE-2026-11981: The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to,…nvd · 2026-07-01
More from NVD Recent CVEs
- unknownCVE-2026-18556: Authentication bypass using an alternate path or channel vulnerability in N-able N-central all…2026-08-01
- unknownCVE-2026-55735: Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticat…2026-08-01
- unknownCVE-2026-55734: Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guar…2026-08-01
- unknownCVE-2026-55733: Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of se…2026-08-01
- unknownCVE-2026-54894: Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of se…2026-08-01