Medium severity5.3NVD Advisory· Published Aug 20, 2024· Updated Jun 17, 2026

CVE-2024-5939

Description

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'setup_wizard' function in all versions up to, and including, 3.13.0. This makes it possible for unauthenticated attackers to read the setup wizard administrative pages.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Givewp/Givewp
cpe:2.3:a:givewp:givewp:*:*:*:*:*:wordpress:*:*
Range: <3.14.0
WordPress/Givewpllm-fuzzy2 versions
<=3.13.0+ 1 more
- (no CPE)range: <=3.13.0
- (no CPE)
Package: https://wordpress.org/plugins/givewp
stellarwp/GiveWP – Donation Plugin and Fundraising Platformv5
Range: 0

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/browser/give/tags/3.12.0/src/Onboarding/Wizard/Page.phpnvdPatch
plugins.trac.wordpress.org/changeset/3120745/nvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/a104f88b-deae-465d-b4c1-9a1fc78e5ee9nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000