{"id":"CVE-2026-111980","kind":"vulnerability","aliases":["CVE-2026-111980"],"related":[],"title":"GiveWP WordPress plugin lets fundraising role edit other users' pages","description":"The GiveWP  WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users with a custom fundraising role to edit, publish and read pages owned by other users, including administrators.","summary":"The GiveWP plugin before 4.19.0.1 checks the wrong page when a user asks to edit or publish a page. A user with the custom fundraising role can therefore edit, publish and read pages owned by other users, including administrators.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["givewp","package","self-hosted","wordpress"],"not_affected_if":["givewp-not-installed","no-fundraising-role-users","plugin-version-4.19.0.1-or-later"],"how_to_check":"- Check the installed GiveWP version in the WordPress admin plugins list or with `wp plugin get give --field=version`\n- Check whether the site assigns the custom fundraising role to any users\n- unknown for anything beyond this, as the sources do not say","fix":"- Update the GiveWP plugin to `4.19.0.1` or later\n- Review which accounts hold the fundraising role and remove it where not needed","status":"open","published_at":"2026-10-25T06:16:31+00:00","first_seen_at":"2026-10-25T06:36:35+00:00","triaged_at":"2026-10-25T06:37:40+00:00","updated_at":"2026-10-25T06:37:40+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T06:37:40Z","model":"claude-haiku-5-5","output":{"fix":"- Update the GiveWP plugin to `4.19.0.1` or later\n- Review which accounts hold the fundraising role and remove it where not needed","reach":"internet","title":"GiveWP WordPress plugin lets fundraising role edit other users' pages","impact":"medium","summary":"The GiveWP plugin before 4.19.0.1 checks the wrong page when a user asks to edit or publish a page. A user with the custom fundraising role can therefore edit, publish and read pages owned by other users, including administrators.","category":"package","nicknames":[],"who_cares":["wordpress","givewp","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Low-privileged fundraiser reads and edits administrator-owned pages","analyst_note":"","how_to_check":"- Check the installed GiveWP version in the WordPress admin plugins list or with `wp plugin get give --field=version`\n- Check whether the site assigns the custom fundraising role to any users\n- unknown for anything beyond this, as the sources do not say","needs_analyst":false,"not_affected_if":["givewp-not-installed","plugin-version-4.19.0.1-or-later","no-fundraising-role-users"],"who_is_affected":"Sites running the GiveWP plugin before 4.19.0.1 that have users with the custom fundraising role are exposed, since those users can reach pages owned by others. Sites without GiveWP, or without any users holding that role, are unlikely to be exposed. Sites on the fixed version can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000611,"input_tokens":3288,"output_tokens":565,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111980':13A,16A '-2026':12A,15A '4.19.0.1':27B,67C 'administr':61B,99C 'allow':81C 'appli':79C 'ask':35B 'capabl':77C 'check':28B 'correct':70C 'custom':46B,85C 'cve':11A,14A 'determin':71C 'edit':7A,37B,51B,89C 'fundrais':5A,47B,86C 'givewp':1A,17B,24B,63C 'host':21B 'includ':60B,98C 'let':4A 'own':56B,94C 'packag':18B 'page':10A,31B,41B,55B,73C,76C,93C 'page-cap':75C 'plugin':3A,25B,65C 'publish':39B,52B,90C 'read':54B,92C 'request':78C 'role':6A,48B,87C 'self':20B 'self-host':19B 'therefor':50B 'user':9A,34B,43B,59B,82C,97C 'wordpress':2A,22B,64C 'wrong':30B","nicknames":[],"mitigations":[],"who_affected":"Sites running the GiveWP plugin before 4.19.0.1 that have users with the custom fundraising role are exposed, since those users can reach pages owned by others. Sites without GiveWP, or without any users holding that role, are unlikely to be exposed. Sites on the fixed version can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T06:16:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111980","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111980","severity":null,"published_at":"2026-10-25T06:16:31+00:00","modified_at":"2026-10-25T06:16:31+00:00","first_seen_at":"2026-10-25T06:36:35+00:00","fetched_at":"2026-10-25T06:36:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}