CVE-2026-111976: GiveWP · Information Exposure
Affects GiveWPSource CVE Database V5
Not known to be exploited.
Data as of 10/25/2026, 08:15:02 UTC
Rated Medium by the CNA (WPScan) · CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| GiveWP | Affected
| Fixed in
|
AI-suggested
Upgrade the GiveWP plugin to version 4.19.0.1 or later, where this issue is fixed. No other mitigation is indicated. Patch status is not explicitly stated in the input data, but the affected versions are clearly defined as before 4.19.0.1, implying that upgrading to 4.19.0.1 or later remediates the vulnerability.
Description
GiveWP WordPress plugin versions before 4.19.0.1 allow unauthenticated users to view unpublished donation forms. This occurs because the plugin does not check user status or capabilities when rendering donation forms on public front-end routes, exposing draft, pending, private, and scheduled forms that WordPress core normally restricts.
Impact
Unauthenticated users can view sensitive information contained in unpublished donation forms that should be restricted. This may lead to unintended disclosure of donation form content and settings, potentially exposing sensitive or private data managed through the GiveWP plugin.
Weaknesses
- CWE-200Exposure of Sensitive Information to an Unauthorized Actor (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #20OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.