Exposure of Unpublished Donation Forms in GiveWP Plugin by WordPress
CVE-2026-111976
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-111976?
The GiveWP WordPress plugin, prior to version 4.19.0.1, is susceptible to an improper authorization vulnerability. This flaw allows unauthorized users to access unpublished donation forms—including drafts, pending, private, and scheduled forms—when rendered on public front-end routes. By circumventing standard security measures implemented by WordPress core, this vulnerability poses significant risks to sensitive donation data that should remain confidential.
Affected Version(s)
GiveWP 0 < 4.19.0.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.