{
 "id": "WPSEC-2026-1538",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1538/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1538/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1538/index.md",
 "title": "GiveWP <= 4.19.0 - Authenticated (GiveWP Worker+) Insecure Direct Object Reference to Arbitrary Page Modification via 'post' Parameter",
 "description": "The GiveWP plugin for WordPress is vulnerable to Insecure Direct Object Reference via the campaign page capability grant in versions 4.14.0 up to, and including, 4.19.0, due to the plugin taking the page being edited from the user-controlled 'post' and 'post_id' query parameters before granting the publish_pages, edit_others_pages, edit_published_pages and delete_others_pages capabilities. This makes it possible for authenticated attackers with the GiveWP Worker role or higher to name a campaign page in the query string while editing and publishing pages created by other users, including published pages, and deleting other users' draft and pending pages.",
 "plugin": {
  "slug": "give",
  "name": "GiveWP",
  "full_name": "GiveWP – Donation Plugin and Fundraising Platform",
  "wordpress_org": "https://wordpress.org/plugins/give/",
  "advisories_url": "https://wpsec.com/vuln/plugin/give/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/give"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.14.0",
    "from_inclusive": true,
    "to": "4.19.0.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.14.0 before 4.19.0.1"
  ]
 },
 "introduced_in": "4.14.0",
 "fixed_in": "4.19.0.1",
 "remediation": "Update to 4.19.0.1 or later.",
 "fix_released": "2026-10-22T16:29:51+00:00",
 "published": "2026-10-23T16:44:59+00:00",
 "updated": "2026-10-23T09:48:24.618621+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1538/",
  "https://plugins.svn.wordpress.org/give/tags/4.19.0.1/",
  "https://wordpress.org/plugins/give/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/give",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-23"
 }
}