CVE-2026-85530 — HIGH (8.1)

Vulnerability Description

The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user account linked to one, including an administrator's.

CVSS Score

8.1

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Related Weaknesses (CWE)

CWE-269

References

https://wpscan.com/vulnerability/83fcea02-345a-443c-b14e-316533a2fd7d/

FAQ

What is CVE-2026-85530?

CVE-2026-85530 is a vulnerability with a CVSS score of 8.1 (HIGH). The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenti...

How severe is CVE-2026-85530?

CVE-2026-85530 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-85530?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.