Path Traversal Vulnerability in GiveWP WordPress Plugin
CVE-2026-111978
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-111978?
The GiveWP WordPress plugin, prior to version 4.19.0.1, contains a flaw in its filename validation process. This vulnerability allows users with elevated custom roles to exploit the system by performing path traversal attacks. As a consequence, attackers can read sensitive contents from JSON-parseable files located anywhere on the server. Additionally, it enables unauthorized modifications to the stored configuration of the GiveWP plugin, potentially compromising the integrity of the application.
Affected Version(s)
GiveWP 0 < 4.19.0.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.