CVE-2026-111978— GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import

Quick assessment

Affected

Unknown GiveWP

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 4.19.0.1 版本之前的 GiveWP WordPress 插件，在从磁盘读取用户提供的文件名之前未进行适当的验证，这允许拥有高权限自定义角色的用户执行路径遍历攻击，披露服务器上任意位置的 JSON 可解析文件内容，并覆盖 GiveWP 插件（4.19.0.1 版本之前）的存储配置。

AI Predicted 7.5 Difficulty: Easy Updated Oct 25, 2026

Possible ATT&CK Techniques 3 AI

T1083 · File and Directory Discovery T1565 · Data Manipulation T1190 · Exploit Public-Facing Application

Updated Oct 25, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import

Source: CVE Program / CVE List V5

Vulnerability Description

The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk, allowing users with a high-privilege custom role to perform path traversal, disclose the contents of JSON-parseable files anywhere on the server, and overwrite the GiveWP WordPress plugin before 4.19.0.1's stored configuration.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Unknown	GiveWP	0 ~ 4.19.0.1	-

II. Public POCs for CVE-2026-111978

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-111978

请登录查看更多情报信息。

https://www.cve.org/CVERecord?id=CVE-2026-111978

Same Patch Batch · Unknown · 2026-10-25 · 15 CVEs total

CVE-2026-114743		InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settin
CVE-2026-115183		Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget
CVE-2026-115214		Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Rol
CVE-2026-115251		Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click
CVE-2026-114742		WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR
CVE-2026-114740		WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizar
CVE-2026-114741		WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR
CVE-2026-111979		GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color
CVE-2026-111980		GiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability
CVE-2026-111981		GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_ad
CVE-2026-111976		GiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View Rou
CVE-2026-110285		WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Web
CVE-2025-15705		Contact Form by Supsystic < 1.8.0 - Admin+ Stored XSS
CVE-2026-94295		Chikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forger

IV. Related Vulnerabilities

Same product: GiveWP

Same vendor: Unknown