Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-111976— GiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View Route

Quick assessment

Affected
Unknown GiveWP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

GiveWP WordPress 插件在 4.19.0.1 版本之前，在公共前端路由渲染捐赠表单时未执行任何状态或权限检查，导致未登录访客能够查看 WordPress 核心本应限制为不可公开访问的未发布（草稿、待审核、私有及已计划）捐赠表单的内容和设置。

AI Predicted 5.3 Difficulty: Trivial

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-111976

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
GiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View Route
Source: CVE Program / CVE List V5
Vulnerability Description
The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public front-end route, allowing unauthenticated visitors to view the content and settings of unpublished (draft, pending, private and scheduled) donation forms that WordPress core otherwise keeps non-public.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unknown GiveWP 0 ~ 4.19.0.1 -

II. Public POCs for CVE-2026-111976

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-111976

请登录查看更多情报信息。

Same Patch Batch · Unknown · 2026-10-25 · 15 CVEs total

CVE-2026-114743 InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settin
CVE-2026-115183 Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget
CVE-2026-115214 Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Rol
CVE-2026-115251 Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click
CVE-2026-114742 WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR
CVE-2026-114740 WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizar
CVE-2026-114741 WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR
CVE-2026-111979 GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color
CVE-2026-111980 GiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability
CVE-2026-111981 GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_ad
CVE-2026-111978 GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import
CVE-2026-110285 WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Web
CVE-2025-15705 Contact Form by Supsystic < 1.8.0 - Admin+ Stored XSS
CVE-2026-94295 Chikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forger

IV. Related Vulnerabilities

Same product: GiveWP
Same vendor: Unknown