High severity · published Sep 16, 2026
CVE-2026-85530
GiveWP < 4.16.8.1 - Unauthenticated Account Takeover via Donor Email Sanitization Mismatch
8.1
CVSS
0.4%
EPSS
No
On KEV
Description
The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user account linked to one, including an administrator's.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GI
GiveWP ·
4.16.6 before 4.16.8.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-85530
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-85530
wpscan.com
https://wpscan.com/vulnerability/83fcea02-345a-443c-b14e-316533a2fd7d/
More from GiveWP
7.5
CVE-2026-14319
GiveWP < 4.16.3 - Unauthenticated Recurring Donor Information Disclosure
6.8
CVE-2026-111979
GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color
6.8
CVE-2026-14318
GiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template Settings
6.5
CVE-2026-85113
GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor Name
6.0
CVE-2026-111978
GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import