Unauthenticated Privilege Escalation in GiveWP Donation Plugin

Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-104405 represents a critical vulnerability affecting GiveWP versions 4.17.0 and earlier, a widely-used WordPress donation plugin deployed across thousands of nonprofits, educational institutions, and fundraising platforms. This unauthenticated privilege escalation flaw (CWE-266: Improper Privilege Management) allows attackers to escalate their access without valid credentials, potentially gaining administrative control over WordPress installations. The vulnerability's CVSS score of 8.1 (high) combined with its unauthenticated nature makes it particularly dangerous—attackers need no prior access or credentials to exploit it, creating an immediate risk for any organization running vulnerable GiveWP versions. Given the sensitive financial and donor data typically processed by donation platforms, successful exploitation could lead to data theft, payment processing abuse, and complete site compromise.

Casky.ai's 224 matched security skills leverage Claude's extended reasoning to map exploit chains related to TA0004 (Privilege Escalation) techniques inherent in this vulnerability. Practitioners using Casky will detect attack patterns including unauthorized account creation, permission escalation attempts, and lateral movement indicators characteristic of privilege escalation exploits. When analyzing logs and network telemetry, the platform identifies suspicious authentication bypasses, POST requests targeting privilege-escalation endpoints, and elevated permission grants to unauthenticated sessions—all hallmarks of CWE-266 exploitation. The skills-based approach enables practitioners to construct detection rules that flag anomalous privilege transitions in WordPress user tables, identify GiveWP-specific parameter tampering, and correlate behavioral indicators (such as unauthenticated users performing admin actions) with known exploitation patterns, transforming raw security data into actionable intelligence aligned with MITRE ATT&CK framework.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-104405.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-104405

Casky has 224 skills that investigate the attack patterns behind CVE-2026-104405. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn