CVE-2023-41665 is a high severity privilege escalation flaw in GiveWP, the WordPress donation plugin, in versions through 2.33.0. Patchstack lists 2.33.1 as the patched release. The NVD record scores it 8.8, while Patchstack shows 7.2, so both are given here. Update the plugin and review who holds manager roles.
What's affected
The NVD record says GiveWP is affected "from n/a through 2.33.0". Patchstack, which we read, agrees on the range and names 2.33.1 as the patched version. Its page title ties the issue to the GiveWP manager role.
The two sources disagree on the score. The NVD record gives 8.8 (High). Patchstack shows CVSS 7.2, also in the High band. Treat it as high either way, and note that the difference comes from how each scorer rated the privileges needed.
The record scores the flaw 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. It can be reached over the network, the attack complexity is low, it requires low privileges, and it needs no user interaction. The impact on confidentiality is high, on integrity high and on availability high. The weakness class is CWE-269 (improper privilege management). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
Source conflict: the record scores this 8.8 and Patchstack scores it 7.2. Both are High. The affected range (through 2.33.0) and the fixed version (2.33.1) match.
How to check if you're exposed
Check the plugin version on every WordPress site you run. If you have WP-CLI access:
wp plugin get give --fields=name,status,version
Or open Plugins in the dashboard and read the version under GiveWP. Anything at or below 2.33.0 is in the affected range. Patchstack names 2.33.1 as the patched version. Do not forget staging copies and rarely visited sites, and remove plugins you no longer use.
What to do now
- Update GiveWP to 2.33.1 or later. With WP-CLI:
wp plugin update give. - List every account with the GiveWP manager role and remove or downgrade those that do not need it.
- Check recent changes to users and roles on sites that took donations during the exposure window.
- If you manage many sites, add the plugin slug to your inventory so the next update reaches all of them.
Why it matters
The weakness is CWE-269, improper privilege management. A user with one role could reach actions meant for a stronger one. The vector shows the attacker needs a low privileged account, so the exposure grows with every account you hand out.
Donation sites hold supporter data and payment related settings, which makes account control more than a tidy-up task. Keep manager roles few, and update as soon as a fix is out.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why do the score and Patchstack differ?
The NVD record lists 8.8 and Patchstack lists 7.2. Both place it in the High band. Use the higher one for planning.
What is the fixed GiveWP version?
Patchstack lists 2.33.1 as patched. The record only says versions through 2.33.0 are affected.
Sources
Last reviewed: 19 October 2026.
