CVE-2026-85530

HighCVSS 8.1/10Last modified Sep 17, 2026

Description

The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user account linked to one, including an administrator's.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published
Sep 16, 2026
Last modified
Sep 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-855319.8Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS ModuCVE-2026-855327.5Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak CVE-2026-855337.6An authorization flaw in MISP allowed an authenticated user to submit a sharing_group_id without verifying that the user was authorized to uCVE-2026-855345.9A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data tCVE-2026-855388.3An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite lacking the required pCVE-2026-85543.1Type Confusion in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer proceCVE-2026-855408.8DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to reaCVE-2026-855415.4DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JCVE-2026-855428.8IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality. An authenticated CVE-2026-855434.3Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged usersCVE-2026-855446.1Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction withCVE-2026-855457.1There is an Vulnerability in some HikCentral Access Control versions. Authenticated low-privilege users can invoke API interfaces that their