Improper Access Control in GiveWP Plugin for WordPress
CVE-2026-111980
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-111980?
The GiveWP WordPress plugin prior to version 4.19.0.1 is susceptible to an improper access control vulnerability. This issue arises because the plugin fails to accurately determine the specific page to which a page-capability request pertains. As a result, users assigned a custom fundraising role can gain unauthorized access, allowing them to edit, publish, and read pages that are owned by other users, including those of administrators. This flaw could potentially be exploited to alter critical content and undermine site integrity.
Affected Version(s)
GiveWP 0 < 4.19.0.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.