CVE-2023-47183 is a medium severity broken access control flaw (CVSS 5.3) in the GiveWP donation plugin for WordPress. Versions up to and including 2.33.1 are affected, and Patchstack lists 2.33.2 as the patched version. Update the plugin to 2.33.2 or later.
What's affected
The CVE record says GiveWP versions from n/a through 2.33.1 are affected. Patchstack's database entry lists vulnerable versions as 2.33.1 and below, and the patched version as 2.33.2. Patchstack dates the entry 31 October 2023 and describes the issue as broken access control with a low priority and no impactful threat.
The CVSS vector in the record shows a network attack with no login and low complexity, with a limited effect on integrity only.
How to check if you're exposed
If you have shell access with WP-CLI, list the plugin version on each WordPress site:
wp plugin get give --field=version
wp plugin list --name=give --fields=name,version,update
In the WordPress dashboard, the same information is on the Plugins page. Anything at 2.33.1 or below is in range.
If you manage many sites, use your hosting panel or a management tool to list plugin versions in bulk. A scan of site manifests can also help; the free dependency scan reads package files in your browser, but plugin versions installed through the WordPress admin need the commands above.
What to do now
- Check the installed GiveWP version on each site.
- Update to 2.33.2 or later, then test a donation form end to end on a staging copy if the site takes payments.
- Turn on automatic updates for the plugin if your change policy allows it.
- Review the roles that exist on the site and remove accounts that do not need to be there.
- Keep a list of your active plugins so the next advisory takes minutes, not days.
Why it matters
The weakness is missing authorization (CWE-862). The plugin performs an action without checking whether the person asking is allowed to do it. The usual cause in WordPress plugins is a request handler that checks that the request is well formed but not that the user has the right capability. The record calls this exploiting incorrectly configured access control security levels.
The effect here is limited. Patchstack rates it low priority and unlikely to be exploited, and the record scores it 5.3 with only a small integrity effect. Still, donation plugins run on sites that handle payments and personal data, so keeping them current is cheap insurance. The CVE is not on the CISA Known Exploited Vulnerabilities list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
GiveWP 2.33.2, according to Patchstack.
Do I need to worry about data theft?
The record shows no confidentiality impact. The effect is a limited change to data, and Patchstack rates it low priority.
Sources
Last reviewed: 19 October 2026.
