Live › vulnerability › CVE-2026-111981
Go to dashboardThe GiveWP donation plugin for WordPress does not check permissions when donor addresses are changed. A user who only has donor-report view access can add, modify or delete the stored address of any donor on the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 06:36 UTC. All times on this page are UTC.
Sites running GiveWP older than 4.19.0.1 that give staff or other non-admin users donor-report access are exposed. Sites on the fixed version, or that never granted donor-report access to lower-privilege users, have no exposure from this flaw.
No product ranges from the sources yet.
wp plugin get give --field=version4.19.0.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report (view) access but not donor-edit access to add, modify, or delete the stored address of any donor on the site.
This page as .md · .json · in your agent: get_signal("CVE-2026-111981")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.