CVE-2019-20360
High
Description
A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally identifiable user information (PII) including names, addresses, IP addresses, and email addresses. Once an API key has been set to any meta key value from the wp_usermeta table, and the token is set to the corresponding MD5 hash of the meta key selected, one can make a request to the restricted endpoints, and thus access sensitive donor data.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Givewp
GivewpPublishedJan 8, 2020
First seenJan 8, 2020
How to fix
Update
- givewp givewp2.5.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| givewp givewp | v < 2.5.5 | 2.5.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.