CVE-2019-20360 - CVE House
Back to Database
Status published High CVE-2019-20360

A flaw in Give before 2.5.5, a WordPress plugin, allowed...

Vulnerability Description

A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally identifiable user information (PII) including names, addresses, IP addresses, and email addresses. Once an API key has been set to any meta key value from the wp_usermeta table, and the token is set to the corresponding MD5 hash of the meta key selected, one can make a request to the restricted endpoints, and thus access sensitive donor data.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-20360

Credits & Attribution

No credits recorded in the NVD database.

References

More from givewp

View All →
CVE-2020-20627
The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows...
Medium 5.3
CVE-2019-9909
The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for...
Medium 6.1
CVE-2019-15317
The give plugin before 2.4.7 for WordPress has XSS via...
Medium 5.4
CVE-2019-13578
A SQL injection vulnerability exists in the Impress GiveWP Give...
Critical 9.8

Affected Vendor

Affected Software

givewp
Vulnerable Versions:
0

Timeline

Official Publish: January 8th, 2020
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.