GiveWP vulnerabilities and threats

The Give - Peer-to-Peer WordPress plugin versions up to 2.9.5 contain an authorization bypass vulnerability. This flaw allows unauthenticated attackers who know or discover valid campaign and team IDs to modify team details and upload media files without proper authorization. The vulnerability can be chained with another (CVE-2026-82568) to achieve unauthenticated remote code execution.

The Give - Peer-to-Peer WordPress plugin versions up to 2.9.3 are vulnerable to a time-based SQL Injection via the 'sort' parameter. This vulnerability allows unauthenticated attackers to inject additional SQL queries, potentially extracting sensitive database information. Exploitation requires at least one existing Peer-to-Peer campaign. The vulnerability can be chained with another (CVE-2026-82663) to achieve unauthenticated remote code execution.