Privilege Escalation in GiveWP Donation Plugin

CVE-2026-118193

What is CVE-2026-118193?

The GiveWP Donation Plugin for WordPress has a vulnerability that allows authenticated users with specific roles to escalate their privileges. This issue arises from inadequate checks in the sanitize_option_donor_default_user_role() function and the improper handling of the give_core_settings_import_callback() AJAX handler. Attackers may exploit this vulnerability to assign themselves elevated user roles, including Administrator, during donor registration. The flaw enables access to sensitive settings, potentially compromising site integrity as user roles can be misconfigured through both settings saving and JSON import paths.

References