CVE-2026-111978: GiveWP · Path Traversal
Affects GiveWPSource CVE Database V5
Not known to be exploited · fixed in 4.19.0.1 : patch GiveWP soon.
Data as of 10/25/2026, 08:15:02 UTC
Rated High by the CNA (WPScan) · CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- Patch
- Available – fixed in 4.19.0.1
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| GiveWP | Affected
| Fixed in
|
AI-suggested
A fix is available in GiveWP version 4.19.0.1. Users should upgrade to version 4.19.0.1 or later to remediate this vulnerability.
Description
The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk, allowing users with a high-privilege custom role to perform path traversal, disclose the contents of JSON-parseable files anywhere on the server, and overwrite the GiveWP WordPress plugin before 4.19.0.1's stored configuration.
Impact
An attacker with a high-privilege custom role can exploit this vulnerability to read sensitive JSON-parseable files on the server and modify the GiveWP plugin's configuration. This could lead to unauthorized disclosure of sensitive information and potential disruption or manipulation of the plugin's behavior.
Weaknesses
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #6OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.