Login Request a demo
High severity · published Jan 8, 2020
CVE-2019-20360
A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally identifiable user information (PII)…
7.5
CVSS
2.5%
EPSS
No
On KEV
Description
A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally identifiable user information (PII) including names, addresses, IP addresses, and email addresses. Once an API key has been set to any meta key value from the wp_usermeta table, and the token is set to the corresponding MD5 hash of the meta key selected, one can make a request to the restricted endpoints, and thus access sensitive donor data.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GI
Givewp · Givewp
before 2.5.5 · source: NVD
Affected product
GI
Givewp
Givewp
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-20360
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-20360
Third Party Advisory
https://wpvulndb.com/vulnerabilities/9889
Exploit
https://www.wordfence.com/blog/2019/09/authentication-bypass-vulnerability-in-givewp-plugin/
More from Givewp
9.8
CVE-2025-0912
GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injection
9.8
CVE-2025-22777
WordPress GiveWP Plugin <= 3.19.3 - PHP Object Injection vulnerability
9.8
CVE-2024-12877
GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection
9.8
CVE-2023-47183
WordPress GiveWP plugin <= 2.33.1 - Broken Access Control vulnerability
9.8
CVE-2024-9634
GiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution