2.7
Low
CVE-2026-111981 The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes,…
Description
The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report (view) access but not donor-edit access to add, modify, or delete the stored address of any donor on the site.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| GiveWP 4.19 | earliest → < 4.19.0.1 | 4.19.0.1 |
References
- wpscan.com wpscan.com
Timeline
- Published
- Last modified
Other CVEs of GiveWP
The 14 CVEs of GiveWP →
CVE-2026-111974
The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form…
5.3
Medium
CVE-2026-111979
The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template…
6.8
Medium
CVE-2026-111978
The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it…
6.0
Medium
CVE-2026-111980
The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies…
5.5
Medium