CVE-2026-111980: GiveWP · Incorrect Authorization
Affects GiveWPSource CVE Database V5
Not known to be exploited · fixed in 4.19.0.1 : patch GiveWP soon.
Data as of 10/25/2026, 08:15:02 UTC
Rated High by the CNA (WPScan) · CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- Patch
- Available – fixed in 4.19.0.1
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| GiveWP | Affected
| Fixed in
|
AI-suggested
Upgrade GiveWP to version 4.19.0.1 or later, where this authorization issue has been fixed. No other mitigation guidance is provided. Patch status is not explicitly confirmed in the input, but the versioning indicates the issue is resolved in 4.19.0.1.
Description
GiveWP WordPress plugin versions before 4.19.0.1 contain an authorization flaw that allows users with a custom fundraising role to edit, publish, and read pages owned by other users, including administrators. This occurs because the plugin does not correctly determine which page a page-capability request applies to.
Impact
Users with a custom fundraising role can improperly edit, publish, and read pages owned by other users, including administrators. This unauthorized access could compromise the integrity and confidentiality of site content managed through the GiveWP plugin.
Summary
CVE-2026-111980 describes an incorrect authorization vulnerability (CWE-863) in the GiveWP WordPress plugin prior to version 4.19.0.1. The flaw arises from improper validation of page-capability requests, enabling users assigned a custom fundraising role to access and modify pages owned by other users, including those owned by administrators. This could lead to unauthorized content modification and potential privilege escalation within the WordPress environment.
Weaknesses
- CWE-863Incorrect Authorization (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #17OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.