{"id":"CVE-2026-111981","kind":"vulnerability","aliases":["CVE-2026-111981"],"related":[],"title":"GiveWP WordPress plugin lets report-only users edit donor addresses","description":"The GiveWP  WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report (view) access but not donor-edit access to add, modify, or delete the stored address of any donor on the site.","summary":"The GiveWP donation plugin for WordPress does not check permissions when donor addresses are changed. A user who only has donor-report view access can add, modify or delete the stored address of any donor on the site.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["givewp","package","self-hosted","wordpress"],"not_affected_if":["default-config","fixed-version"],"how_to_check":"- Check the installed GiveWP version in the WordPress admin plugin list or with `wp plugin get give --field=version`\n- Review which user roles have donor-report access in the GiveWP settings","fix":"- Update the GiveWP plugin to `4.19.0.1` or later\n- Review donor-report role grants until the update is applied","status":"open","published_at":"2026-10-25T06:16:31+00:00","first_seen_at":"2026-10-25T06:36:35+00:00","triaged_at":"2026-10-25T06:37:39+00:00","updated_at":"2026-10-25T06:37:39+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T06:37:39Z","model":"claude-haiku-5-5","output":{"fix":"- Update the GiveWP plugin to `4.19.0.1` or later\n- Review donor-report role grants until the update is applied","reach":"internet","title":"GiveWP WordPress plugin lets report-only users edit donor addresses","impact":"medium","summary":"The GiveWP donation plugin for WordPress does not check permissions when donor addresses are changed. A user who only has donor-report view access can add, modify or delete the stored address of any donor on the site.","category":"package","nicknames":[],"who_cares":["wordpress","givewp","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Low-privilege report users can alter any donor's stored address","analyst_note":"","how_to_check":"- Check the installed GiveWP version in the WordPress admin plugin list or with `wp plugin get give --field=version`\n- Review which user roles have donor-report access in the GiveWP settings","needs_analyst":false,"not_affected_if":["default-config","fixed-version"],"who_is_affected":"Sites running GiveWP older than 4.19.0.1 that give staff or other non-admin users donor-report access are exposed. Sites on the fixed version, or that never granted donor-report access to lower-privilege users, have no exposure from this flaw.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000568,"input_tokens":3300,"output_tokens":476,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111981':14A,17A '-2026':13A,16A '4.19.0.1':68C 'access':48B,90C,96C 'add':50B,98C 'address':11A,36B,56B,78C,104C 'allow':80C 'capabl':73C 'chang':38B,79C 'check':32B,74C 'cve':12A,15A 'delet':53B,101C 'donat':26B 'donor':10A,35B,45B,59B,77C,87C,94C,107C 'donor-edit':93C 'donor-report':44B,86C 'edit':9A,95C 'givewp':1A,18B,25B,64C 'grant':85C 'handl':76C 'host':22B 'let':4A 'modifi':51B,99C 'packag':19B 'perform':71C 'permiss':33B 'plugin':3A,27B,66C 'report':6A,46B,88C 'report-on':5A 'self':21B 'self-host':20B 'site':62B,110C 'store':55B,103C 'user':8A,40B,81C 'view':47B,89C 'wordpress':2A,23B,29B,65C","nicknames":[],"mitigations":[],"who_affected":"Sites running GiveWP older than 4.19.0.1 that give staff or other non-admin users donor-report access are exposed. Sites on the fixed version, or that never granted donor-report access to lower-privilege users, have no exposure from this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T06:16:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111981","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111981","severity":null,"published_at":"2026-10-25T06:16:31+00:00","modified_at":"2026-10-25T06:16:31+00:00","first_seen_at":"2026-10-25T06:36:35+00:00","fetched_at":"2026-10-25T06:36:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}