CVE-2019-20360: givewp Improper Authentication
Vulnerability summary
CVE-2019-20360 is a high (CVSS 7.5) Improper Authentication vulnerability in givewp. EPSS estimates a 2.46% chance of exploitation in the next 30 days, higher than 84.2% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 2.5.5.
Timeline
- 08-01-2020PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally identifiable user information (PII) including names, addresses, IP addresses, and email addresses. Once an API key has been set to any meta key value from the wp_usermeta table, and the token is set to the corresponding MD5 hash of the meta key selected, one can make a request to the restricted endpoints, and thus access sensitive donor data.
CVSS metrics
5 scores · 3 sources · 3 versions- wordfenceSource7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
2.46%
Chance of exploitation in the next 30 days
Percentile
84%
Versus all other CVEs
30-day change
0.00 pp
From 2.46% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wordfence.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Givewp1 product
- givewp< 2.5.5
Wordpress1 product
- give≤ 2.5.4 (fixed in 2.5.5)
2 vendors · 2 products
References
3 links- www.wordfence.com/blog/2019/09/authentication-bypass-vulnerability-in-givewp-plugin/X Refsource MISCExploitThird Party Advisory