{"id":"CVE-2026-118193","kind":"vulnerability","aliases":["CVE-2026-118193"],"related":[],"title":"GiveWP WordPress plugin: donor settings let attackers grant admin role","description":"The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.19.1 via the `donor_default_user_role` parameter. This is due to the `sanitize_option_donor_default_user_role()` function applying only a narrow literal check against the string `'administrator'` rather than enforcing the plugin's own `give_get_donor_safe_user_roles()` allowlist on save, and due to the `give_core_settings_import_callback()` AJAX handler writing imported JSON directly into the `give_settings` option via `update_option()` without invoking the sanitize filter at all. This makes it possible for authenticated attackers with the GiveWP Manager role (holding the `manage_give_settings` capability) and above to configure donor registration to assign privileged WordPress roles — up to and including Administrator via the import path — to every new donor account created through the platform. Via the settings save path, the Administrator role is blocked but any other elevated role (Editor, Author, etc.) is accepted; via the Tools › Import JSON path, the sanitize filter is bypassed entirely, allowing the Administrator role itself to be stored and subsequently applied to all newly registered donor accounts.","summary":"The GiveWP donation plugin for WordPress up to and including 4.19.1 lets a user with the GiveWP Manager role set the role given to new donors, and the settings import path skips the check that blocks Administrator. An attacker can therefore make every new donor account an Administrator on the site.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["givewp","package","self-hosted","wordpress"],"not_affected_if":["no-givewp-manager-users","plugin-above-4.19.1","plugin-not-installed"],"how_to_check":"- Check the installed GiveWP version in the WordPress admin plugins list or with `wp plugin get give --field=version`\n- Review the `donor_default_user_role` value in the GiveWP settings and confirm it is not a privileged role\n- Review WordPress users with administrator rights that were created recently through donor registration","fix":"- Move GiveWP to a version later than `4.19.1`; the sources do not name the fixed version","status":"open","published_at":"2026-11-05T05:18:19+00:00","first_seen_at":"2026-11-05T05:31:54+00:00","triaged_at":"2026-11-05T05:33:38+00:00","updated_at":"2026-11-05T05:33:38+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T05:33:38Z","model":"claude-haiku-5-5","output":{"fix":"- Move GiveWP to a version later than `4.19.1`; the sources do not name the fixed version","reach":"internet","title":"GiveWP WordPress plugin: donor settings let attackers grant admin role","impact":"high","summary":"The GiveWP donation plugin for WordPress up to and including 4.19.1 lets a user with the GiveWP Manager role set the role given to new donors, and the settings import path skips the check that blocks Administrator. An attacker can therefore make every new donor account an Administrator on the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","givewp","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker gains WordPress administrator rights through new donor accounts","analyst_note":"Confirm the first fixed GiveWP version from the vendor changelog or the WordPress plugin page; the NVD entry gives none.","how_to_check":"- Check the installed GiveWP version in the WordPress admin plugins list or with `wp plugin get give --field=version`\n- Review the `donor_default_user_role` value in the GiveWP settings and confirm it is not a privileged role\n- Review WordPress users with administrator rights that were created recently through donor registration","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-above-4.19.1","no-givewp-manager-users"],"who_is_affected":"Sites running the GiveWP plugin at version 4.19.1 or earlier are exposed. The attacker needs an account with the GiveWP Manager role or higher, which holds the manage_give_settings capability. Sites without GiveWP, or where only trusted staff hold that role, face much less risk.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000777,"input_tokens":4551,"output_tokens":644,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118193':13A,16A '-2026':12A,15A '4.19.1':33B,96C 'accept':238C 'account':68B,214C,267C 'admin':9A 'administr':59B,70B,125C,205C,225C,253C 'ajax':151C 'allow':251C 'allowlist':139C 'appli':116C,261C 'assign':197C 'attack':7A,61B,178C 'authent':177C 'author':235C 'block':58B,228C 'bypass':249C 'callback':150C 'capabl':189C 'check':56B,121C 'configur':193C 'core':147C 'creat':215C 'cve':11A,14A 'default':100C,112C 'direct':156C 'donat':25B,76C 'donor':4A,48B,67B,99C,111C,135C,194C,213C,266C 'due':106C,143C 'editor':234C 'elev':232C 'enforc':128C 'entir':250C 'escal':88C 'etc':236C 'everi':65B,211C 'filter':169C,247C 'function':115C 'fundrais':79C 'get':134C 'give':133C,146C,159C,187C 'given':45B 'givewp':1A,17B,24B,39B,75C,181C 'grant':8A 'handler':152C 'hold':184C 'host':21B 'import':52B,149C,154C,208C,242C 'includ':32B,95C,204C 'invok':166C 'json':155C,243C 'let':6A,34B 'liter':120C 'make':64B,173C 'manag':40B,182C,186C 'narrow':119C 'new':47B,66B,212C 'newli':264C 'option':110C,161C,164C 'packag':18B 'paramet':103C 'path':53B,209C,223C,244C 'platform':80C,218C 'plugin':3A,26B,77C,81C,130C 'possibl':175C 'privileg':87C,198C 'rather':126C 'regist':265C 'registr':195C 'role':10A,41B,44B,102C,114C,138C,183C,200C,226C,233C,254C 'safe':136C 'sanit':109C,168C,246C 'save':141C,222C 'self':20B 'self-host':19B 'set':5A,42B,51B,148C,160C,188C,221C 'site':73B 'skip':54B 'store':258C 'string':124C 'subsequ':260C 'therefor':63B 'tool':241C 'updat':163C 'user':36B,101C,113C,137C 'version':91C 'via':97C,162C,206C,219C,239C 'vulner':85C 'without':165C 'wordpress':2A,22B,28B,83C,199C 'write':153C","nicknames":[],"mitigations":[],"who_affected":"Sites running the GiveWP plugin at version 4.19.1 or earlier are exposed. The attacker needs an account with the GiveWP Manager role or higher, which holds the manage_give_settings capability. Sites without GiveWP, or where only trusted staff hold that role, face much less risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["givewp","high","package","selfhosted","wordpress"],"campaign_type":null,"first_public_at":"2026-11-05T05:18:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118193","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118193","severity":null,"published_at":"2026-11-05T05:18:19+00:00","modified_at":"2026-11-05T05:18:19+00:00","first_seen_at":"2026-11-05T05:31:54+00:00","fetched_at":"2026-11-05T05:31:54+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}