CVE-2026-111981
Received Received - Intake

Unauthorized Address Modification in GiveWP WordPress Plugin

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: WPScan

Description
The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report (view) access but not donor-edit access to add, modify, or delete the stored address of any donor on the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-111981
EUVD
EUVD-2026-109346

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown GiveWP 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the GiveWP WordPress plugin versions before 4.19.0.1. It allows authenticated users with donor-report (view) access but without donor-edit permissions to modify donor addresses. The plugin fails to check user capabilities when handling address changes, enabling unauthorized edits, additions, or deletions of donor addresses.

Detection Guidance

To detect this vulnerability, check the GiveWP plugin version on your WordPress site. If it is below 4.19.0.1, the site is vulnerable. Logs may show unauthorized address modifications by users with donor-report access but not donor-edit permissions.

Impact Analysis

An attacker with donor-report access could alter donor addresses, potentially leading to misdirected donations, privacy breaches, or fraud. Donors' personal information could be compromised if addresses are changed maliciously.

Compliance Impact

This vulnerability could violate GDPR by exposing or altering donor personal data without consent. For HIPAA, if donor addresses include protected health information, unauthorized changes could breach compliance. Both standards require protecting personal data integrity.

Mitigation Strategies

Update the GiveWP plugin to version 4.19.0.1 or later immediately. Review user roles with donor-report access to ensure they do not have unnecessary permissions. Monitor donor address changes for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111981. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart