CVE-2026-111981: GiveWP · Missing Authorization
Affects GiveWPSource CVE Database V5
Not known to be exploited · fixed in 4.19.0.1 : patch GiveWP soon.
Data as of 10/25/2026, 08:15:02 UTC
Rated High by the CNA (WPScan) · CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- Patch
- Available – fixed in 4.19.0.1
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| GiveWP | Affected
| Fixed in
|
AI-suggested
Upgrade GiveWP to version 4.19.0.1 or later where this authorization check issue is fixed. No other mitigation guidance is provided. Patch status is confirmed by the version boundary indicating the fix in 4.19.0.1.
Description
The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report (view) access but not donor-edit access to add, modify, or delete the stored address of any donor on the site.
Impact
Users with limited donor-report access can escalate their privileges to modify sensitive donor address information, potentially compromising data integrity and privacy of donor records on affected sites.
Summary
CVE-2026-111981 describes a missing authorization vulnerability (CWE-862) in the GiveWP WordPress plugin prior to version 4.19.0.1. The plugin fails to verify user capabilities when processing donor address changes, enabling users granted only donor-report (view) access to perform unauthorized modifications to donor address data, including adding, changing, or deleting addresses.
Weaknesses
- CWE-862Missing Authorization (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #4OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.