{"id":"CVE-2026-96333","published":"2026-10-09T10:16:44.460","lastModified":"2026-10-09T16:17:33.230","description":"Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP give allows Identity Spoofing.This issue affects GiveWP: from n/a through 4.16.8.1.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwes":["CWE-290"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-16-8-1-payment-bypass-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers to bypass authentication by spoofing identities in the GiveWP plugin, potentially enabling unauthorized access to donation management features. The flaw stems from improper validation of user identities during authentication flows.","exploitability":"Exploitation appears straightforward with no special preconditions required, as the vulnerability allows direct identity spoofing without needing credentials or session tokens.","blast_radius":"If exploited, this could allow attackers to access donation records, modify donor information, and potentially process unauthorized transactions across affected GiveWP installations.","remediation":"Upgrade to version 4.16.8.1 or later to remediate this authentication bypass vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","web","wp-plugin","donation"],"model":"garnet-coder","analyzedAt":"2026-10-17T09:03:05.599Z"}}