Technical impact
The GiveWP WordPress plugin before version 4.19.0.1 contains a flaw in the way it resolves page‑level capabilities. Because the plugin does not correctly bind a capability request to the specific page, a user with the custom fundraising role can edit, publish, and read pages owned by other users, including administrators. This flaw allows such a user to modify any page on the site, effectively granting content‑manipulation privileges. The weakness is a failure to correctly check permissions for a resource, as defined by CWE-863.
Affected Systems
Any WordPress installation that uses GiveWP version prior to 4.19.0.1 is affected. The issue is confined to the GiveWP plugin and does not impact other WordPress plugins or core components.
Risk and Exploitability
The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% shows a very low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers need only an authenticated account that holds the custom fundraising role to exploit it. Once authenticated, the local attacker can modify any page on the site. Based on the description, the likely attack vector is an authenticated user utilizing the plugin’s capability check to perform arbitrary page changes.
