CVE-2026-111981— GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_addresses

Quick assessment

Affected

Unknown GiveWP

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在版本 4.19.0.1 之前的 GiveWP WordPress 插件在处理捐赠者地址变更时，未执行权限（capability）检查。这导致被授予“捐赠者报告（查看）”权限但未被授予“捐赠者编辑”权限的用户，能够添加、修改或删除网站上任意捐赠者的已存储地址。

AI Predicted 6.5 Difficulty: Easy Updated Oct 25, 2026

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Updated Oct 25, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_addresses

Source: CVE Program / CVE List V5

Vulnerability Description

The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report (view) access but not donor-edit access to add, modify, or delete the stored address of any donor on the site.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Unknown	GiveWP	0 ~ 4.19.0.1	-

II. Public POCs for CVE-2026-111981

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-111981

请登录查看更多情报信息。

Other References for CVE-2026-111981 (1)

https://wpscan.com/vulnerability/9fae25ff-51e6-4137-83d6-e752374dae57/ exploit vdb-entry technical-description

https://www.cve.org/CVERecord?id=CVE-2026-111981

Same Patch Batch · Unknown · 2026-10-25 · 15 CVEs total

CVE-2026-114743		InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settin
CVE-2026-115183		Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget
CVE-2026-115214		Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Rol
CVE-2026-115251		Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click
CVE-2026-114742		WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR
CVE-2026-114740		WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizar
CVE-2026-114741		WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR
CVE-2026-111979		GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color
CVE-2026-111980		GiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability
CVE-2026-111978		GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import
CVE-2026-111976		GiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View Rou
CVE-2026-110285		WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Web
CVE-2025-15705		Contact Form by Supsystic < 1.8.0 - Admin+ Stored XSS
CVE-2026-94295		Chikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forger

IV. Related Vulnerabilities

Same product: GiveWP

Same vendor: Unknown