Live › vulnerability › CVE-2026-111978
Go to dashboardThe GiveWP WordPress plugin before 4.19.0.1 does not validate a user-supplied filename before reading it from disk. A user with a high-privilege custom role can read JSON-parseable files anywhere on the server and overwrite the plugin's stored configuration.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 06:36 UTC. All times on this page are UTC.
Sites running GiveWP before that have custom WordPress roles with high privileges in GiveWP. Sites without GiveWP, or with only administrator-level users and no custom roles, face less exposure, though the sources do not say this explicitly.
4.19.0.1No product ranges from the sources yet.
wp plugin get give --field=version if WP-CLI is available.4.19.0.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk, allowing users with a high-privilege custom role to perform path traversal, disclose the contents of JSON-parseable files anywhere on the server, and overwrite the GiveWP WordPress plugin before 4.19.0.1's stored configuration.
This page as .md · .json · in your agent: get_signal("CVE-2026-111978")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.