WordPress Plugin Vulnerabilities

GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_addresses

Description

The plugin does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report (view) access but not donor-edit access to add, modify, or delete the stored address of any donor on the site.

Proof of Concept

Affects Plugins

Plugin icon
give
Fixed in 4.19.0.1

References

CVE
CVE-2026-111981

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
2.7 (low)

Miscellaneous

Original Researcher
Hariom Singh
Submitter
Hariom Singh
Verified
Yes
WPVDB ID
9fae25ff-51e6-4137-83d6-e752374dae57

Timeline

Publicly Published
2026-10-23 (about 2 days ago)
Added
2026-10-23 (about 1 day ago)
Last Updated
2026-10-23 (about 1 day ago)

Other

Published
Title
Published
2024-08-14
Title
SmartSearchWP <= 2.4.4 - Unauthenticated Log Purge
Published
2026-03-20
Title
WP-Chatbot for Messenger <= 4.9 - Missing Authorization to Unauthenticated Chatbot Configuration Takeover
Published
2025-07-03
Title
WP Human Resource Management 2.0.0 - 2.2.17 - Missing Authorization to Authenticated (Employee+) Privilege Escalation via wp_ajax_hrm_insert_employee AJAX Action
Published
2026-01-08
Title
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories < 4.9.4 - Missing Authorization to Authenticated (Contributor+) Workflow Manipulation
Published
2025-01-24
Title
Internal Links Manager < 2.5.3 - Missing Authorization