Live › vulnerability › CVE-2026-111976
Go to dashboardThe GiveWP donation plugin for WordPress renders unpublished donation forms (draft, pending, private, scheduled) on public front-end routes without checking status or capability. An unauthenticated visitor can read the content and settings of those forms.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 06:36 UTC. All times on this page are UTC.
Sites running the GiveWP plugin before 4.19.0.1 that have donation forms in draft, pending, private or scheduled status. Sites without GiveWP, or with the plugin fully updated, are not exposed. Whether the exposed settings include anything sensitive is unknown from the sources.
No product ranges from the sources yet.
wp plugin get give --field=version4.19.0.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public front-end route, allowing unauthenticated visitors to view the content and settings of unpublished (draft, pending, private and scheduled) donation forms that WordPress core otherwise keeps non-public.
This page as .md · .json · in your agent: get_signal("CVE-2026-111976")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.