CVE-2026-32425

Payment Gateway Pix For GiveWP <= 2.2.3 - Missing Authorization

mediumMissing Authorization

5.3

CVSS Score

5.3

CVSS Score

medium

Severity

2.2.4

Patched in

47d

Time to patch

Description

The Payment Gateway Pix For GiveWP plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.2.3. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

None

Confidentiality

Low

Integrity

None

Availability

Technical Details

Affected versions<=2.2.3

PublishedFebruary 28, 2026

Last updatedApril 15, 2026

Affected pluginpayment-gateway-pix-for-givewp

What Changed in the Fix

Changes introduced in v2.2.4

Loading patch diff...

Source Code

WordPress.org SVN

Vulnerable v2.2.3

Browse source Download .zip

Patched v2.2.4

Browse source Download .zip

Research Plan

Unverified

# Vulnerability Analysis Report: CVE-2026-32425 ## 1. Vulnerability Summary The **Payment Gateway Pix For GiveWP** plugin (versions <= 2.2.3) contains a missing authorization vulnerability within its administrative AJAX handlers. Specifically, functions designed for administrative tasks (such as sa…

Show full research plan

Vulnerability Analysis Report: CVE-2026-32425

1. Vulnerability Summary

The Payment Gateway Pix For GiveWP plugin (versions <= 2.2.3) contains a missing authorization vulnerability within its administrative AJAX handlers. Specifically, functions designed for administrative tasks (such as saving plugin settings or dismissing notifications) are registered without appropriate capability checks (e.g., current_user_can( 'manage_give_settings' )). This allows unauthenticated attackers to trigger these actions by sending requests to wp-admin/admin-ajax.php.

2. Attack Vector Analysis

Endpoint: wp-admin/admin-ajax.php
Action: pgpfg_save_settings (inferred from typical Link Nacional plugin patterns) or pgpfg_dismiss_notice.
Authentication: None (Unauthenticated). The vulnerability allows nopriv access or fails to check capabilities for authenticated users.
Vulnerable Parameter: action, along with setting fields like lkn-payment-pix-key or lkn-payment-pix-environment.
Severity: CVSS 5.3 (Medium). While it allows modifying settings, the "Low" integrity impact suggests it may be limited to settings that do not facilitate a full site takeover but can redirect donation information (Pix keys).

3. Code Flow

Entry Point: A request is made to admin-ajax.php with `action

Research Findings

Static analysis — not yet PoC-verified

Summary

The Payment Gateway Pix For GiveWP plugin for WordPress is vulnerable to unauthorized access and settings modification due to missing capability checks on its administrative AJAX handlers in versions up to 2.2.3. This allows unauthenticated attackers to perform administrative actions, such as dismissing plugin notices or potentially modifying Pix payment configuration settings.

Vulnerable Code

// From Admin/js/pgpfg-admin.js @ 2.2.3

      const noticeDiv = document.createElement('div')
      noticeDiv.className = 'notice notice-info is-dismissible pgpfg-notice'
      noticeDiv.innerHTML = '<p>' + __('GiveWP Pix: You can receive donations with the help of various payment gateways. Access the settings to configure.', 'payment-gateway-pix-for-givewp') + ' <a href="' + wpApiSettings.root.replace('/wp-json/', '/wp-admin/edit.php?post_type=give_forms&page=give-settings&tab=gateways&section=lkn-payment-pix') + '">' + __('Settings', 'payment-gateway-pix-for-givewp') + '</a></p>'

      noticeDiv.querySelector('.notice-dismiss').onclick = function () {
        jQuery.ajax({
          url: ajaxurl,
          method: 'POST',
          data: {
            action: 'pgpfg_dismiss_notice'
          }
        })
      }

Security Fix

diff -ru /home/deploy/wp-safety.org/data/plugin-versions/payment-gateway-pix-for-givewp/2.2.3/Admin/css/pgpfg-admin.css /home/deploy/wp-safety.org/data/plugin-versions/payment-gateway-pix-for-givewp/2.2.4/Admin/css/pgpfg-admin.css
--- /home/deploy/wp-safety.org/data/plugin-versions/payment-gateway-pix-for-givewp/2.2.3/Admin/css/pgpfg-admin.css	2025-08-29 12:39:22.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/payment-gateway-pix-for-givewp/2.2.4/Admin/css/pgpfg-admin.css	2026-02-18 15:15:38.000000000 +0000
@@ -34,12 +34,6 @@
     display: none;
 }
 
-.PGPFGForGivewpAdminSettingsDiv tr {
-    /*padding: 10px 14px;*/
-    /*margin: auto;*/
-    max-width: 850px;
-}
-
 .PGPFGForGivewpAdminSettingsDiv td {
     background-color: #fff;
     display: flex;
@@ -54,13 +48,15 @@
     align-items: center;
 }
 
-.PGPFGForGivewpAdminSettingsDiv td label {
+.PGPFGForGivewpAdminSettingsDiv td label,
+.PGPFGForGivewpAdminSettingsDiv td div.lkn-pix-subtitle {
     font-weight: bold;
     font-size: 16px;
     margin: 3px 4px;
 }
 
-.PGPFGForGivewpAdminSettingsDiv td label.lkn-pix-subtitle p {
+.PGPFGForGivewpAdminSettingsDiv td label.lkn-pix-subtitle,
+.PGPFGForGivewpAdminSettingsDiv td div.lkn-pix-subtitle p {
     color: rgb(60, 67, 74);
     font-weight: 400;
     margin: 0px !important;
... (truncated)

Exploit Outline

An attacker can exploit this vulnerability by sending an unauthenticated POST request to the WordPress AJAX endpoint (`/wp-admin/admin-ajax.php`). By specifying the `action` parameter as `pgpfg_dismiss_notice` or `pgpfg_save_settings`, the attacker can trigger the corresponding PHP callback functions. Since these functions lack `current_user_can()` checks and the hooks may be registered for unauthenticated users (via `wp_ajax_nopriv_`), the attacker can modify plugin state or configuration—such as changing the Pix key to redirect donations—without needing any administrative privileges.

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/b9f2be74-fedd-4844-95a4-a84318489e58?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database