Live › vulnerability › CVE-2026-111980
Go to dashboardThe GiveWP plugin before 4.19.0.1 checks the wrong page when a user asks to edit or publish a page. A user with the custom fundraising role can therefore edit, publish and read pages owned by other users, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 06:36 UTC. All times on this page are UTC.
Sites running the GiveWP plugin before 4.19.0.1 that have users with the custom fundraising role are exposed, since those users can reach pages owned by others. Sites without GiveWP, or without any users holding that role, are unlikely to be exposed. Sites on the fixed version can skip it.
No product ranges from the sources yet.
wp plugin get give --field=version4.19.0.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users with a custom fundraising role to edit, publish and read pages owned by other users, including administrators.
This page as .md · .json · in your agent: get_signal("CVE-2026-111980")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.