This vulnerability in StellarWP GiveWP (<= 4.14.5) is caused by missing authorization checks, which leads to incorrect access control enforcement. The issue allows an attacker to exploit the plugin remotely without authentication or user interaction, potentially gaining limited access to confidential information. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a network-based attack with low complexity and no impact on integrity or availability. No vendor advisory or patch information is currently available, and the vulnerability is publicly disclosed as of April 29, 2026.

An attacker can exploit this vulnerability remotely without authentication or user interaction to gain limited access to confidential information within the GiveWP plugin. There is no impact on data integrity or system availability. The vulnerability does not require privileges and has a low attack complexity, making exploitation feasible but limited in scope. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific temporary mitigations are provided in the available data.