GiveWP Email Normalization Flaw Enables Account Takeover

The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user account linked to one, including an administrator's.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-85530 exploits inconsistent email address normalization in the GiveWP WordPress plugin, allowing attackers to impersonate arbitrary donors and reset passwords for any user account—including administrators. The vulnerability affects all versions before 4.16.8.1 and requires no authentication, making it particularly dangerous for WordPress sites using GiveWP for donation management. Organizations relying on this plugin for fundraising, nonprofits, and e-commerce platforms face immediate risk of account compromise and unauthorized administrative access.

Casky's 224 mapped skills detect this attack pattern by analyzing MITRE ATT&CK technique TA0004 (Privilege Escalation) through Claude's extended reasoning capabilities. Practitioners would identify suspicious activity patterns including: unexpected password reset requests tied to donation workflows, mismatched email normalization in authentication logs (e.g., donor@example.com vs donor+tag@example.com resolving to the same account), and lateral movement attempts immediately following donor account access. The platform flags inconsistent identifier handling between storage and lookup operations, anomalous administrative account modifications linked to GiveWP donation records, and authentication bypass attempts exploiting email case sensitivity or special character handling—enabling security teams to detect exploitation before attackers establish persistence.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-85530.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-85530

Casky has 224 skills that investigate the attack patterns behind CVE-2026-85530. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn