CVE-2026-11981 is a CSRF vulnerability in the GiveWP – Donation Plugin and Fundraising Platform for WordPress. The issue arises from the lack of nonce validation in the give_set_notification_status_handler() function, which handles donation email notification status. An attacker can exploit this by crafting a forged request that, when executed by an authenticated site administrator, disables donation email notifications without their consent. This vulnerability affects versions up to and including 4.15.3. No official patch or remediation level has been provided as of the publication date.

The vulnerability allows an unauthenticated attacker to cause a site administrator to disable donation email notifications via a forged request. This impacts the integrity of the notification system by preventing legitimate donation emails from being sent. There is no direct impact on confidentiality or availability reported. The CVSS score of 4.3 reflects a medium severity with low complexity and no privileges required but requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about clicking on unsolicited links and consider implementing additional CSRF protections or monitoring for unexpected changes to notification settings. Follow updates from the vendor stellarwp for any forthcoming patches or official mitigations.