5.3
Moyenne
CVE-2026-111976 The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation…
Description
The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public front-end route, allowing unauthenticated visitors to view the content and settings of unpublished (draft, pending, private and scheduled) donation forms that WordPress core otherwise keeps non-public.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| GiveWP 4.19 | premières → < 4.19.0.1 | 4.19.0.1 |
Références
- wpscan.com wpscan.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de GiveWP
Les 14 CVE de GiveWP →
CVE-2026-111974
The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form…
5.3
Moyenne
CVE-2026-111979
The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template…
6.8
Moyenne
CVE-2026-111978
The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it…
6.0
Moyenne
CVE-2026-111980
The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies…
5.5
Moyenne