# GiveWP <= 4.19.0 - Authenticated (GiveWP Worker+) Insecure Direct Object Reference to Arbitrary Page Modification via 'post' Parameter

- **ID:** WPSEC-2026-1538
- **Plugin:** GiveWP – Donation Plugin and Fundraising Platform (`give`), https://wordpress.org/plugins/give/
- **Affected versions:** from 4.14.0 before 4.19.0.1
- **Fixed in:** 4.19.0.1 (Update to 4.19.0.1 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-23)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/give
- **Fix released:** 2026-10-22
- **Published:** 2026-10-23
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1538/

## Description

The GiveWP plugin for WordPress is vulnerable to Insecure Direct Object Reference via the campaign page capability grant in versions 4.14.0 up to, and including, 4.19.0, due to the plugin taking the page being edited from the user-controlled 'post' and 'post_id' query parameters before granting the publish_pages, edit_others_pages, edit_published_pages and delete_others_pages capabilities. This makes it possible for authenticated attackers with the GiveWP Worker role or higher to name a campaign page in the query string while editing and publishing pages created by other users, including published pages, and deleting other users' draft and pending pages.

## References

- https://wpsec.com/vuln/WPSEC-2026-1538/
- https://plugins.svn.wordpress.org/give/tags/4.19.0.1/
- https://wordpress.org/plugins/give/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1538/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.