CVE-2026-42642

The vulnerability is a missing authorization issue in the GiveWP plugin for WordPress, affecting versions up to and including 4.14.5. The plugin fails to properly enforce access control checks, allowing exploitation of incorrectly configured security levels [1].

Attackers can exploit this by sending crafted requests to plugin functions that lack proper authorization checks. While the exact prerequisites are not detailed, the issue is classified as a broken access control vulnerability that could allow an unprivileged user to execute higher-privileged actions [1].

The impact is considered low severity by the vendor, but such vulnerabilities are known to be used in mass-exploit campaigns targeting thousands of websites. An attacker could potentially gain unauthorized access to sensitive functions, leading to data exposure or privilege escalation [1].

The issue is patched in version 4.14.6. Users are strongly advised to update immediately. Patchstack users can enable auto-updates for vulnerable plugins. No workaround is available [1].