Address Modification Flaw in GiveWP Plugin by WordPress
CVE-2026-111981
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-111981?
The GiveWP plugin for WordPress prior to version 4.19.0.1 contains a significant security flaw that permits users with donor-report (view) access, but lacking donor-edit permissions, to manipulate the stored addresses of donors. This vulnerability stems from inadequate capability checks during the handling of donor address modifications, allowing unauthorized changes to sensitive donor information.
Affected Version(s)
GiveWP 0 < 4.19.0.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.