CVE-2026-85530: CWE-269 Improper Privilege Management in GiveWP
The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user account linked to one, including an administrator's.
AI Analysis
Technical Summary
CVE-2026-85530 describes an improper privilege management vulnerability (CWE-269) in the GiveWP WordPress plugin before version 4.16.8.1. The vulnerability is due to inconsistent normalization of donor email addresses between the stored value and the lookup process. This inconsistency allows unauthenticated attackers to impersonate arbitrary donors and reset the WordPress password of any user account associated with those donors, including administrators. This could lead to unauthorized account takeover.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to reset the password of any WordPress user linked to a donor record, including administrator accounts. This could lead to full site compromise by allowing the attacker to gain administrative access.
Mitigation Recommendations
Upgrade the GiveWP plugin to version 4.16.8.1 or later, where this vulnerability is fixed. Since the affected versions are explicitly stated, applying the official update is the recommended remediation.
CVE-2026-85530: CWE-269 Improper Privilege Management in GiveWP
Description
The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user account linked to one, including an administrator's.
Affected software
GiveWP
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-85530 describes an improper privilege management vulnerability (CWE-269) in the GiveWP WordPress plugin before version 4.16.8.1. The vulnerability is due to inconsistent normalization of donor email addresses between the stored value and the lookup process. This inconsistency allows unauthenticated attackers to impersonate arbitrary donors and reset the WordPress password of any user account associated with those donors, including administrators. This could lead to unauthorized account takeover.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to reset the password of any WordPress user linked to a donor record, including administrator accounts. This could lead to full site compromise by allowing the attacker to gain administrative access.
Mitigation Recommendations
Upgrade the GiveWP plugin to version 4.16.8.1 or later, where this vulnerability is fixed. Since the affected versions are explicitly stated, applying the official update is the recommended remediation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-04T08:39:31.737Z
- State
- PUBLISHED
Threat ID: 6aaa32e255bf5e2cf517fb37
Added to database: 09/16/2026, 06:10:42 UTC
Last enriched: 09/16/2026, 06:19:15 UTC
Last updated: 09/17/2026, 01:45:08 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.