{"id":"CVE-2026-104405","published":"2026-10-06T09:17:39.013","lastModified":"2026-10-06T15:04:25.990","description":"Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-266"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-17-0-privilege-escalation-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"GiveWP versions 4.17.0 and earlier contain a privilege escalation flaw that allows unauthenticated users to gain administrative access to the WordPress site. This occurs due to improper privilege checks in the donation processing functionality.","exploitability":"Exploitation is relatively straightforward requiring no authentication or user interaction, with the only precondition being that the vulnerable GiveWP plugin version is installed and active on a WordPress site.","blast_radius":"If exploited, attackers could gain full administrative control over affected WordPress sites, potentially leading to complete compromise including data theft, defacement, or use as a launchpad for further attacks.","remediation":"Upgrade to GiveWP version 4.17.1 or later to remediate this privilege escalation vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","wordpress","plugin","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:59:36.754Z"}}