CVE-2026-82663: Give - Peer-to-Peer <= 2.9.5 - Authorization Bypass to Team Modification and Media Upload

Q: Who can exploit this issue, and what information do they need?

An unauthenticated attacker can exploit it remotely without a WordPress account. They need to know or discover an existing campaign ID and team ID.

Q: What actions can an attacker perform through the authorization bypass?

An attacker can change a team's name, story, goal, access settings, and notification settings. They can also set the team's profile image URL and upload WordPress-allowed media files as parentless attachments.

Q: Are sites using the affected plugin potentially exposed by default?

The issue affects all Give - Peer-to-Peer versions through 2.9.5. Exploitation depends on the attacker being able to identify an existing campaign and team ID.

Q: What is the potential impact if this issue is chained with another vulnerability?

This vulnerability can be combined with CVE-2026-82568 to achieve unauthenticated remote code execution.

Published Nov 15, 2026

Updated

The Give - Peer-to-Peer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.9.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers who know or discover an existing campaign and team ID to modify the team's name, story, goal, access and notification settings, set its profile image URL, and upload WordPress-allowed media files as parentless attachments. This vulnerability can be combined with CVE-2026-82568 to achieve unauthenticated remote code execution.

Affected Software

0 affected components

Event History

Nov 15, 2026

CVE Published

via MITRE·09:34 AM

Data Sourced

via MITRE·09:34 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue, and what information do they need?

An unauthenticated attacker can exploit it remotely without a WordPress account. They need to know or discover an existing campaign ID and team ID.

What actions can an attacker perform through the authorization bypass?

An attacker can change a team's name, story, goal, access settings, and notification settings. They can also set the team's profile image URL and upload WordPress-allowed media files as parentless attachments.

Are sites using the affected plugin potentially exposed by default?

The issue affects all Give - Peer-to-Peer versions through 2.9.5. Exploitation depends on the attacker being able to identify an existing campaign and team ID.

What is the potential impact if this issue is chained with another vulnerability?

This vulnerability can be combined with CVE-2026-82568 to achieve unauthenticated remote code execution.

CVE-2026-82663: Give - Peer-to-Peer <= 2.9.5 - Authorization Bypass to Team Modification and Media Upload

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue, and what information do they need?

What actions can an attacker perform through the authorization bypass?

Are sites using the affected plugin potentially exposed by default?

What is the potential impact if this issue is chained with another vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue, and what information do they need?

What actions can an attacker perform through the authorization bypass?

Are sites using the affected plugin potentially exposed by default?

What is the potential impact if this issue is chained with another vulnerability?