The Give - Peer-to-Peer plugin for WordPress up to version 2.9.5 suffers from an authorization bypass vulnerability. This flaw allows unauthenticated attackers who know or discover existing campaign and team IDs to modify team settings and upload media files without proper authorization. The vulnerability can be chained with another (CVE-2026-82568) to achieve unauthenticated remote code execution.