Auth bypass in Givewp
CVE-2019-20360
A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally identifiable user information (PII) including names, addresses, IP addresses, and email addresses. Once an API key has been set to any meta key value from the wp_usermeta table, and the token is set to the corresponding MD5 hash of the meta key selected, one can make a request to the restricted endpoints, and thus access sensitive donor data.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.025 (83.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 84th percentile — 83.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.025 · newest: 0.025 · change: 0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- wpvulndb.com/vulnerabilities/9889 (Third Party Advisory)
- www.wordfence.com/blog/2019/09/authentication-bypass-vulnerability-in-givewp-pl… (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2019-20360?
- CVE-2019-20360 is a high-severity vulnerability in Givewp, classified under Improper Authentication. CVSS score: 7.5/10. Published 2020-01-08.
- How severe is CVE-2019-20360?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2019-20360 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.