CVE-2026-14317CWE-862broken-access-control

CVE-2026-14317

Medium · published July 31, 2026

CVSS v3.1

5.3

EPSS

Percentile

21.9

In the wild

Unconfirmed

What it is

The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations through a payment gateway the administrator has disabled.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00304 · 21.9th percentile
Weakness: CWE-862 · Missing Authorization
Published: 2026-07-31T11:16Z

References (1)

https://wpscan.com/vulnerability/fa6f5470-b30d-4052-aacd-a0571d4678ac/ · [email protected]

EPSS history

Timeline

31 JUL 06:00Z
GiveWP < 4.16.3 - Unauthenticated Payment Gateway Restriction Bypass
cvelistv5