{"id":"CVE-2026-111976","kind":"vulnerability","aliases":["CVE-2026-111976"],"related":[],"title":"GiveWP WordPress plugin exposes unpublished donation forms to anonymous visitors","description":"The GiveWP  WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public front-end route, allowing unauthenticated visitors to view the content and settings of unpublished (draft, pending, private and scheduled) donation forms that WordPress core otherwise keeps non-public.","summary":"The GiveWP donation plugin for WordPress renders unpublished donation forms (draft, pending, private, scheduled) on public front-end routes without checking status or capability. An unauthenticated visitor can read the content and settings of those forms.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["givewp","package","self-hosted","wordpress"],"not_affected_if":["givewp-updated","no-unpublished-forms"],"how_to_check":"- Check the installed GiveWP version in the WordPress admin plugins list or with `wp plugin get give --field=version`\n- Confirm whether any donation forms are in draft, pending, private or scheduled status that should stay hidden","fix":"- Update the GiveWP plugin to `4.19.0.1` or later\n- unknown for any interim workaround","status":"open","published_at":"2026-10-25T06:16:31+00:00","first_seen_at":"2026-10-25T06:36:35+00:00","triaged_at":"2026-10-25T06:37:43+00:00","updated_at":"2026-10-25T06:37:43+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T06:37:43Z","model":"claude-haiku-5-5","output":{"fix":"- Update the GiveWP plugin to `4.19.0.1` or later\n- unknown for any interim workaround","reach":"internet","title":"GiveWP WordPress plugin exposes unpublished donation forms to anonymous visitors","impact":"low","summary":"The GiveWP donation plugin for WordPress renders unpublished donation forms (draft, pending, private, scheduled) on public front-end routes without checking status or capability. An unauthenticated visitor can read the content and settings of those forms.","category":"package","nicknames":[],"who_cares":["wordpress","givewp","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Anonymous visitors read settings and content of unpublished donation forms","analyst_note":"","how_to_check":"- Check the installed GiveWP version in the WordPress admin plugins list or with `wp plugin get give --field=version`\n- Confirm whether any donation forms are in draft, pending, private or scheduled status that should stay hidden","needs_analyst":false,"not_affected_if":["givewp-updated","no-unpublished-forms"],"who_is_affected":"Sites running the GiveWP plugin before `4.19.0.1` that have donation forms in draft, pending, private or scheduled status. Sites without GiveWP, or with the plugin fully updated, are not exposed. Whether the exposed settings include anything sensitive is unknown from the sources.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000594,"input_tokens":3320,"output_tokens":525,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111976':13A,16A '-2026':12A,15A '4.19.0.1':65C 'allow':86C 'anonym':9A 'capabl':47B,72C 'check':44B,73C 'content':54B,92C 'core':106C 'cve':11A,14A 'donat':6A,25B,31B,77C,102C 'draft':33B,97C 'end':41B,84C 'expos':4A 'form':7A,32B,59B,78C,103C 'front':40B,83C 'front-end':39B,82C 'givewp':1A,17B,24B,61C 'host':21B 'keep':108C 'non':110C 'non-publ':109C 'otherwis':107C 'packag':18B 'pend':34B,98C 'perform':68C 'plugin':3A,26B,63C 'privat':35B,99C 'public':38B,81C,111C 'read':52B 'render':29B,75C 'rout':42B,85C 'schedul':36B,101C 'self':20B 'self-host':19B 'set':56B,94C 'status':45B,70C 'unauthent':49B,87C 'unpublish':5A,30B,96C 'view':90C 'visitor':10A,50B,88C 'without':43B 'wordpress':2A,22B,28B,62C,105C","nicknames":[],"mitigations":[],"who_affected":"Sites running the GiveWP plugin before `4.19.0.1` that have donation forms in draft, pending, private or scheduled status. Sites without GiveWP, or with the plugin fully updated, are not exposed. Whether the exposed settings include anything sensitive is unknown from the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T06:16:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111976","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111976","severity":null,"published_at":"2026-10-25T06:16:31+00:00","modified_at":"2026-10-25T06:16:31+00:00","first_seen_at":"2026-10-25T06:36:35+00:00","fetched_at":"2026-10-25T06:36:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}