PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-111980 GiveWP CVE debrief

The GiveWP WordPress plugin before 4.19.0.1 has a vulnerability allowing users with a custom fundraising role to edit, publish, and read pages owned by other users, including administrators. This issue arises from the plugin's incorrect determination of which page a page-capability request applies to. As a result, users with custom fundraising roles may have elevated privileges, potentially leading to unauthorized access to sensitive pages and data exposure. Administrators should assess their exposure and prioritize remediation.

Vendor
GiveWP
Product
GiveWP WordPress plugin
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-25
Original CVE updated
2026-10-25
Advisory published
2026-10-25
Advisory updated
2026-10-25

Who should care

WordPress administrators and users with custom fundraising roles should assess exposure and prioritize remediation. This vulnerability may impact the security of pages and data within WordPress installations using the GiveWP plugin, particularly those with custom fundraising roles. Affected parties should review their installations and update to version 4.19.0.1 or later if necessary.

Why it matters

CVE-2026-111980 allows users with custom fundraising roles to edit, publish, and read pages owned by other users, including administrators, in the GiveWP WordPress plugin before version 4.19.0.1.

  • Elevation of privileges for users with custom fundraising roles
  • Potential unauthorized access to sensitive pages
  • Data exposure and potential leakage

Technical summary

The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users with a custom fundraising role to edit, publish and read pages owned by other users, including administrators. This vulnerability is related to improper handling of page-capability requests, which can lead to privilege escalation and unauthorized access.

Defensive priority

Assess exposure and prioritize remediation for WordPress installations using the GiveWP plugin.

Recommended defensive actions

  • Assess WordPress installations for exposure to CVE-2026-111980
  • Prioritize remediation for installations with custom fundraising roles
  • Verify plugin version and update to 4.19.0.1 or later if necessary

Evidence notes

The vulnerability was reported by WPScan and is related to the GiveWP WordPress plugin. The issue allows users with custom fundraising roles to edit, publish, and read pages owned by other users, including administrators, due to incorrect page-capability request handling. WPScan provided details on the vulnerability, which affects GiveWP versions before 4.19.0.1. Defenders should verify their installations and update to the latest version if necessary.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-111980 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-111980

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-111980 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-111980

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.