Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-111980— GiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability Grant

Quick assessment

Affected
Unknown GiveWP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在版本 4.19.0.1 之前的 GiveWP WordPress 插件未能正确判断页面权限请求所适用的页面，这导致拥有自定义筹款角色的用户可以编辑、发布并查看其他用户（包括管理员）所拥有的页面。

AI Predicted 6.5 Difficulty: Trivial

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-111980

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
GiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability Grant
Source: CVE Program / CVE List V5
Vulnerability Description
The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users with a custom fundraising role to edit, publish and read pages owned by other users, including administrators.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unknown GiveWP 0 ~ 4.19.0.1 -

II. Public POCs for CVE-2026-111980

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-111980

请登录查看更多情报信息。

Same Patch Batch · Unknown · 2026-10-25 · 15 CVEs total

CVE-2026-114743 InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settin
CVE-2026-115183 Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget
CVE-2026-115214 Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Rol
CVE-2026-115251 Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click
CVE-2026-114742 WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR
CVE-2026-114740 WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizar
CVE-2026-114741 WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR
CVE-2026-111979 GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color
CVE-2026-111981 GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_ad
CVE-2026-111978 GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import
CVE-2026-111976 GiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View Rou
CVE-2026-110285 WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Web
CVE-2025-15705 Contact Form by Supsystic < 1.8.0 - Admin+ Stored XSS
CVE-2026-94295 Chikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forger

IV. Related Vulnerabilities

Same product: GiveWP
Same vendor: Unknown