Skip to content
Sign in
5.5 Medium

CVE-2026-111980 The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies…

Description

The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users with a custom fundraising role to edit, publish and read pages owned by other users, including administrators.

Affected products and versions

Product Affected versions Fixed in
GiveWP 4.19 earliest → < 4.19.0.1 4.19.0.1

Other CVEs of GiveWP

The 14 CVEs of GiveWP →
CVE-2026-111974 The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form… 5.3 Medium CVE-2026-111978 The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it… 6.0 Medium CVE-2026-111976 The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation… 5.3 Medium CVE-2026-111979 The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template… 6.8 Medium
Track this CVE