CyberRota Analysis
AI-GeneratedThe GiveWP WordPress plugin prior to version 4.16.8.1 has a vulnerability that allows unauthenticated users to manipulate donor email addresses, potentially gaining access to any user account, including those of administrators, by resetting passwords. This flaw arises from inconsistent normalization of email addresses during donor lookup processes. WordPress site administrators using the affected plugin should prioritize updating to the latest version to mitigate the risk of unauthorized account access.
Original NVD Description
The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user account linked to one, including an administrator's.