Live › vulnerability › CVE-2026-111974
Go to dashboardThe GiveWP donation plugin for WordPress accepts donations in a currency the site or form does not allow, and compares amount limits as bare numbers. An unauthenticated visitor can therefore donate below a form's minimum or fixed amount.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 07:28 UTC. All times on this page are UTC.
Sites running GiveWP before 4.19.0.1 that use donation forms with minimum or fixed amounts are affected. Sites without GiveWP, or running a fixed version, can skip it. The sources do not say whether non-default currency settings are required.
No product ranges from the sources yet.
wp plugin get give --field=version (unknown whether the sources give a different path)4.19.0.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount limits as bare numbers, allowing unauthenticated users to make donations below a form's configured minimum or fixed amount.
This page as .md · .json · in your agent: get_signal("CVE-2026-111974")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.