GiveWP Plugin Privilege Escalation Vulnerability

Executive Summary

CVE-2026-111980 is a vulnerability in the GiveWP WordPress plugin before version 4.19.0.1. It involves incorrect authorization where the plugin fails to properly determine which page a page-capability request applies to. This allows users with a custom fundraising role to edit, publish, and read pages owned by other users, including administrators.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the GiveWP plugin using WordPress admin panel or via command line with: wp plugin list --name=give. If the version is below 4.19.0.1, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized users with a custom fundraising role to modify or access pages they should not, including pages owned by administrators. This could lead to unauthorized changes, data exposure, or loss of control over critical pages on a WordPress site.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, potentially violating compliance requirements under GDPR or HIPAA. Unauthorized changes to pages may expose personal or protected health information, leading to legal and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Update the GiveWP plugin to version 4.19.0.1 or later immediately. Remove any custom fundraising roles that grant excessive permissions until the update is applied.

Useful 0 Not Useful 0