SZB-38f5b90194
EUVD lists unauthenticated broken access control in GiveWP 4.19.0.1 and earlier
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Nexcess
- Product
- GiveWP
- First seen
Summary
The EU Vulnerability Database entry EUVD-2026-114310, as relayed in a Mastodon post, describes an unauthenticated broken access control flaw in GiveWP versions up to 4.19.0.1. The entry gives a CVSS v3.1 score of 6.5 and was last updated 2026-10-30.
If you use Nexcess
Update GiveWP to a version later than 4.19.0.1 if the vendor has released one
Review donation and donor records for unexpected access or changes
Restrict admin access to the site until the update is applied
What the sources say 1
· Mastodon: “Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions.” Source