CVE-2026-111981

GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_addresses

View on CVE.org
Published Oct 25, 2026 CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Description
The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report (view) access but not donor-edit access to add, modify, or delete the stored address of any donor on the site.

Analysis

AI-generated

Technical impact

GiveWP, a WordPress donation plugin, contains a flaw in the donor_manage_addresses feature that skips a capability check. The result is that any user with donor-report (view) permissions can add, edit, or delete the stored address of any donor on the site. The vulnerability therefore allows unauthorized modification of donor data, but it does not grant code execution or privilege escalation.

Affected Systems

All installations of the GiveWP plugin for WordPress older than version 4.19.0.1 are affected. The issue is resolved in version 4.19.0.1 and later.

Risk and Exploitability

The CVSS v3.1 score of 2.7 indicates low severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers need authenticated access and possession of a role with donor-report capability; once they have such credentials, they can alter donor addresses, potentially compromising data integrity and affecting donation flows.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the GiveWP plugin to version 4.19.0.1 or later to restore proper capability checks on donor address changes.
  • If an upgrade cannot be performed immediately, remove the donor-report capability from any roles that do not require it or redesign those roles to have view‑only permissions.
  • Disable the donor reports feature in the plugin settings until the patch is applied, preventing any address modifications by exposed roles.

Generated by OpenCVE AI on October 26, 2026 at 14:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Weaknesses CWE-284
Type Values Removed Values Added
Weaknesses CWE-862
Metrics cvssV3_1

{'score': 2.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Wordpress-extensions
Wordpress-extensions givewp
Weaknesses CWE-284
Vendors & Products Wordpress-extensions
Wordpress-extensions givewp
Type Values Removed Values Added
Description The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report (view) access but not donor-edit access to add, modify, or delete the stored address of any donor on the site.
Title GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_addresses
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
WPScan
Published
Updated
Oct 26, 2026, 10:13 AM
Reserved
Oct 17, 2026, 7:27 PM

View source JSON

Updated
Oct 26, 2026, 10:07 AM

JSON

Status
Deferred
Published
Oct 25, 2026, 6:16 AM
Modified
Oct 26, 2026, 1:50 PM

View source JSON

No data.

Updated
Oct 26, 2026, 3:00 PM

JSON