This vulnerability (CVE-2026-73348) affects GiveWP, a product by Nexcess, and is categorized as CWE-862 Missing Authorization. It allows unauthenticated attackers to bypass access controls in versions before 4.16.6. The CVSS 3.1 base score is 6.5 (medium), with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity but not availability. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

An unauthenticated attacker could exploit this broken access control vulnerability to gain unauthorized access to certain functionalities or data within GiveWP, potentially leading to limited confidentiality and integrity impacts. There is no indication of availability impact or active exploitation currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitor vendor communications for updates. No specific temporary mitigations are provided in the available data.