CVE-2026-118193
Deferred Deferred - Pending Action

Privilege Escalation in GiveWP Donation Plugin

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: Wordfence

Description
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.19.1 via the `donor_default_user_role` parameter. This is due to the `sanitize_option_donor_default_user_role()` function applying only a narrow literal check against the string `'administrator'` rather than enforcing the plugin's own `give_get_donor_safe_user_roles()` allowlist on save, and due to the `give_core_settings_import_callback()` AJAX handler writing imported JSON directly into the `give_settings` option via `update_option()` without invoking the sanitize filter at all. This makes it possible for authenticated attackers with the GiveWP Manager role (holding the `manage_give_settings` capability) and above to configure donor registration to assign privileged WordPress roles — up to and including Administrator via the import path — to every new donor account created through the platform. Via the settings save path, the Administrator role is blocked but any other elevated role (Editor, Author, etc.) is accepted; via the Tools › Import JSON path, the sanitize filter is bypassed entirely, allowing the Administrator role itself to be stored and subsequently applied to all newly registered donor accounts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-118193
EUVD
EUVD-2026-117330

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
stellarwp GiveWP – Donation Plugin and Fundraising Platform 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the GiveWP WordPress plugin allows authenticated users with the GiveWP Manager role or higher to escalate their privileges. It occurs because the plugin fails to properly restrict donor user roles during registration or settings import. Attackers can assign elevated WordPress roles like Administrator or Editor to new donor accounts, potentially taking full control of the site.

Detection Guidance

Check WordPress sites with GiveWP plugin versions up to 4.19.1. Look for unauthorized role changes in donor accounts or settings. Review logs for suspicious AJAX import activity via Tools > Import JSON.

Impact Analysis

If exploited, this vulnerability could allow attackers to gain administrative access to your WordPress site. This could lead to complete site takeover, data theft, malware installation, or disruption of services. The impact depends on the attacker's goals and the site's importance.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data. GDPR requires protecting personal data, while HIPAA mandates strict access controls for health information. A breach could result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update GiveWP plugin to the latest version. Remove the GiveWP Manager role if unnecessary. Audit donor roles and settings for unauthorized changes. Monitor for new donor accounts with elevated roles.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118193. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...