CVE-2026-96333: WordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerability

Q: Does exploitation require an authenticated account or user interaction?

No. The CVSS vector indicates that no privileges and no user interaction are required, and the attack can be performed over the network.

Q: What security impact is indicated by the available scoring data?

The available CVSS data indicates high impact to integrity, with no indicated confidentiality or availability impact.

Published Oct 9, 2026

Updated

Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP give allows Identity Spoofing.This issue affects GiveWP: from n/a through 4.16.8.1.

Affected Software

1 affected component

Stellarwp GiveWP<=4.16.8.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress GiveWP plugin to a version that resolves this vulnerability.
Fixed in 4.16.9

Event History

Oct 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Does exploitation require an authenticated account or user interaction?

No. The CVSS vector indicates that no privileges and no user interaction are required, and the attack can be performed over the network.

What security impact is indicated by the available scoring data?

The available CVSS data indicates high impact to integrity, with no indicated confidentiality or availability impact.

CVE-2026-96333: WordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Does exploitation require an authenticated account or user interaction?

What security impact is indicated by the available scoring data?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require an authenticated account or user interaction?

What security impact is indicated by the available scoring data?