CVE-2023-4247

The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_sendwp_disconnect function. This makes it possible for unauthenticated attackers to deactivate the SendWP plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352
• CWE-352

• https://plugins.trac.wordpress.org/browser/give/trunk/includes/admin/misc-functions.php?rev=2772225#L333Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2974851%40give%2Ftrunk&old=2973080%40give%2Ftrunk&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e32d9104-5a39-4455-b76a-e24ae787bdfd?source=cveProduct, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/give/trunk/includes/admin/misc-functions.php?rev=2772225#L333Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2974851%40give%2Ftrunk&old=2973080%40give%2Ftrunk&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e32d9104-5a39-4455-b76a-e24ae787bdfd?source=cveProduct, Third Party Advisory

Published

Jan 11, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-42463Wazuh is a free and open source platform used for threat pre…7.8
• CVE-2023-42464A Type Confusion vulnerability was found in the Spotlight RP…9.8
• CVE-2023-42465Sudo before 1.9.15 might allow row hammer attacks (for authe…7
• CVE-2023-42467QEMU through 8.0.0 could trigger a division by zero in scsi_…5.5
• CVE-2023-42468The com.cutestudio.colordialer application through 2.1.8-2 f…5.3
• CVE-2023-42469The com.full.dialer.top.secure.encrypted application through…3.3
• CVE-2023-42470The Imou Life com.mm.android.smartlifeiot application throug…9.8
• CVE-2023-42471The wave.ai.browser application through 1.0.35 for Android a…9.8
• CVE-2023-42472Due to insufficient file type validation, SAP BusinessObject…7.3
• CVE-2023-42473S/4HANA Manage (Withholding Tax Items) - version 106, does n…5.4
• CVE-2023-42474SAP BusinessObjects Web Intelligence - version 420, has a UR…5.4
• CVE-2023-42475The Statutory Reporting application has a vulnerable file st…4.3