CVE-2026-96333: Authentication Bypass by Spoofing in Liquid Web / StellarWP GiveWP

CVE-2026-96333 describes an authentication bypass by spoofing vulnerability in the GiveWP plugin by Liquid Web / StellarWP. This flaw allows an attacker to spoof identity and bypass authentication controls, impacting versions from initial release through 4.16.8.1. The vulnerability has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), indicating it is remotely exploitable without privileges or user interaction, causing a high impact on integrity but no confidentiality or availability impact. No vendor advisory or patch information is available in the provided data.

An attacker can bypass authentication mechanisms by spoofing identity, leading to unauthorized actions that compromise the integrity of the affected system. There is no reported impact on confidentiality or availability. The vulnerability is remotely exploitable without requiring privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitor vendor communications for updates and consider implementing additional access controls or network restrictions to limit exposure.