CVE-2026-111976 GiveWP CVE debrief

Who should care

WordPress site administrators using the GiveWP plugin should assess their exposure and update to version 4.19.0.1 or later. They should also verify access controls for donation forms and review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, they should check relevant monitoring, detection, and logs for exposed assets that need extra review.

Why it matters

CVE-2026-111976 allows unauthenticated visitors to access unpublished GiveWP donation forms due to missing status and capability checks. WordPress site administrators should assess exposure, verify access controls, and update to version 4.19.0.1 or later.

• Unauthenticated access to sensitive donation form content
• Potential exposure of unpublished donation form settings
• Verification of access controls for donation forms is required
• Update priority for GiveWP plugin versions before 4.19.0.1

Technical summary

The GiveWP WordPress plugin before 4.19.0.1 does not perform status or capability checks when rendering donation forms on public front-end routes. This allows unauthenticated visitors to view the content and settings of unpublished (draft, pending, private, and scheduled) donation forms, potentially leading to unauthorized access to sensitive information. To address this vulnerability, site administrators should update to version 4.19.0.1 or later and verify access controls for donation forms. The vulnerability arises from inadequate checks in the plugin's code, which can be exploited by unauthenticated visitors.

Defensive priority

Assess exposure of GiveWP plugin versions before 4.19.0.1 and verify access controls for donation forms.

Recommended defensive actions

• Assess exposure of GiveWP plugin versions before 4.19.0.1
• Verify access controls for donation forms
• Update GiveWP to version 4.19.0.1 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE description notes that the GiveWP plugin does not perform status or capability checks for donation forms on public routes, allowing access to unpublished forms. This information is corroborated by the official CVE Program record and the NIST NVD detail page. To verify, defenders should check the plugin version and review access controls for donation forms.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.