CVE-2026-104405

Summary

GiveWP versions 4.17.0 and earlier contain a privilege escalation flaw that allows unauthenticated users to gain administrative access to the WordPress site. This occurs due to improper privilege checks in the donation processing functionality.

Exploitability

Exploitation is relatively straightforward requiring no authentication or user interaction, with the only precondition being that the vulnerable GiveWP plugin version is installed and active on a WordPress site.

Blast radius

If exploited, attackers could gain full administrative control over affected WordPress sites, potentially leading to complete compromise including data theft, defacement, or use as a launchpad for further attacks.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to GiveWP version 4.17.1 or later to remediate this privilege escalation vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.