CVE-2026-97196— WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerability
Quick assessment
Affected
Liquid Web / StellarWP GiveWP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Liquid Web / StellarWP 开发的 GiveWP 插件存在“输入中不安全的等价性验证不当”漏洞，可导致身份认证绕过。 该问题影响 GiveWP 版本：从 n/a 到 4.16.9（含）。
Possible ATT&CK Techniques 1 AI
T1556 · Modify Authentication Process
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-97196
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Validation of Unsafe Equivalence in Input vulnerability in Liquid Web / StellarWP GiveWP allows Authentication Bypass.
This issue affects GiveWP: from n/a through 4.16.9.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1289
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Liquid Web / StellarWP | GiveWP | n/a ~ 4.16.9 | - |
|
II. Public POCs for CVE-2026-97196
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-97196
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-97196 (1)
IV. Related Vulnerabilities
Same product: GiveWP
-
CVE-2026-97066
WordPress GiveWP plugin <= 4.16.9 - Insecure Direct Object R -
CVE-2026-96834
WordPress GiveWP plugin <= 4.16.9 - Sensitive Data Exposure -
CVE-2026-96830
WordPress GiveWP plugin <= 4.16.9 - Cross Site Scripting (XS -
CVE-2026-85113
GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execut -
CVE-2026-85530
GiveWP < 4.16.8.1 - Unauthenticated Account Takeover via Don
Same vendor: Liquid Web / StellarWP
-
CVE-2026-82222
WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution -
CVE-2026-66599
WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scriptin -
CVE-2026-49772
WordPress The Events Calendar plugin 6.15.12-6.16.2 - SQL In -
CVE-2026-42662
WordPress Event Tickets plugin <= 5.27.5 - Bypass Vulnerabil -
CVE-2026-34900
WordPress GiveWP plugin <= 4.14.2 - Reflected Cross Site Scr
Same weakness: CWE-1289
-
CVE-2026-101015
Trusted Domain Project OpenDMARC policy.c improper validatio -
CVE-2026-100837
Edgeless Systems Contrast through 1.20.0 Credential Leak via -
CVE-2026-86831
Improper validation of pod identifier uniqueness in aws-netw -
CVE-2026-88255
mpp Tempo keys its pre-broadcast dedup reserve on the caller -
CVE-2026-76977
Clickjacking vulnerability in SAPUI5(Frame Options Allowlist
V. Comments for CVE-2026-97196
No comments yet