CVE-2026-111981 GiveWP CVE debrief

Who should care

WordPress site administrators and users with donor-report access should assess exposure and verify access controls to prevent unauthorized changes to donor addresses. This includes reviewing the plugin's configuration, verifying donor-report access controls, and updating the plugin to the latest version if necessary. Additionally, security teams should review the vulnerability and assess the potential impact on their organization's WordPress deployments.

Why it matters

CVE-2026-111981 allows users with donor-report access to modify donor addresses without proper authorization, potentially leading to data integrity issues and unauthorized changes.

• Unauthorized donor address changes may lead to data integrity issues
• Donor address modifications may require verification and updates to downstream systems
• Exposure may allow attackers to manipulate donor information for phishing or other malicious activities
• Verification of donor-report access controls is necessary to prevent unauthorized changes

Technical summary

The GiveWP WordPress plugin before 4.19.0.1 lacks capability checks for donor address changes, allowing users with donor-report access to modify donor addresses. This vulnerability can lead to unauthorized changes and data integrity issues. Site administrators should verify donor-report access controls and assess exposure to this vulnerability. The vulnerability is related to the plugin's handling of donor address changes, and defenders should review the plugin's configuration and update to the latest version if necessary.

Defensive priority

Assess exposure and verify donor-report access controls.

Recommended defensive actions

• Assess exposure by checking if donor-report access is granted to users without donor-edit access
• Verify donor address change controls and capability checks
• Review and update GiveWP plugin versions to 4.19.0.1 or later
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The GiveWP plugin's capability check failure allows users with donor-report access to modify donor addresses without proper authorization. Defenders should verify donor-report access controls and assess exposure to this vulnerability. The source details are limited, and further verification is necessary to determine the full scope of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.