GiveWP <= 4.19.0 - Authenticated (GiveWP Worker+) Insecure Direct Object Reference to Arbitrary Page Modification via 'post' Parameter
- ID
- WPSEC-2026-1538
- Plugin
- GiveWP – Donation Plugin and Fundraising Platform (give)
- Affected
- from 4.14.0 before 4.19.0.1
- Remediation
- Update to 4.19.0.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-23
- Attack surface
- GiveWP on WPSec AttackSurface
- Fix released
- Published
Description
The GiveWP plugin for WordPress is vulnerable to Insecure Direct Object Reference via the campaign page capability grant in versions 4.14.0 up to, and including, 4.19.0, due to the plugin taking the page being edited from the user-controlled 'post' and 'post_id' query parameters before granting the publish_pages, edit_others_pages, edit_published_pages and delete_others_pages capabilities. This makes it possible for authenticated attackers with the GiveWP Worker role or higher to name a campaign page in the query string while editing and publishing pages created by other users, including published pages, and deleting other users' draft and pending pages.
References
- https://wpsec.com/vuln/WPSEC-2026-1538/
- https://plugins.svn.wordpress.org/give/tags/4.19.0.1/
- https://wordpress.org/plugins/give/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS