GiveWP Authentication Bypass via Input Validation Flaw

CVE-2026-97196 is a critical authentication bypass vulnerability (CVSS 9.1) affecting GiveWP versions through 4.16.9, stemming from improper validation of unsafe equivalence in user input. The vulnerability allows attackers to circumvent authentication mechanisms without valid credentials, potentially gaining unauthorized access to donation systems, donor data, and administrative functions. This poses significant risk to nonprofits, charities, and organizations using GiveWP for fundraising, as threat actors could manipulate authentication logic through crafted input that exploits type juggling or equivalence checking flaws in the platform's validation routines.

While this CVE does not directly map to MITRE ATT&CK techniques in its current classification, Casky's security skills powered by Claude AI with extended reasoning would identify the attack patterns underlying this vulnerability by analyzing input manipulation tactics associated with T1110 (Brute Force), T1078 (Valid Accounts), and T1556 (Modify Authentication Process). Practitioners using Casky would observe findings related to suspicious authentication requests with malformed or type-confused input parameters, unusual login patterns that bypass normal validation checks, and access logs showing successful authentication without corresponding credential verification. The platform's 754 security skills would correlate these indicators to reveal the root cause: improper handling of PHP loose comparison operators or unsafe equivalence checks that allow attackers to authenticate as legitimate users by submitting specially crafted payloads that the validation logic incorrectly accepts as equivalent to valid credentials.