Vulnerabilities / GiveWP / WPSEC-2026-1541
GiveWP <= 4.19.0 - Unauthenticated Information Exposure of Unpublished Donation Forms
Medium 5.3
CWE-200Fixed in 4.19.0.1
- ID
- WPSEC-2026-1541
- Plugin
- GiveWP – Donation Plugin and Fundraising Platform (give)
- Affected
- from 3.0.0 before 4.19.0.1
- Remediation
- Update to 4.19.0.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-23
- Attack surface
- GiveWP on WPSec AttackSurface
- Fix released
- Published
Description
The GiveWP plugin for WordPress is vulnerable to Information Exposure via the donation-form-view and donation-form-view-preview routes in versions 3.0.0 up to, and including, 4.19.0, due to the routes rendering any donation form by ID without checking that it is published or that the user may view private forms. This makes it possible for unauthenticated attackers to view the content of draft and private donation forms.
References
- https://wpsec.com/vuln/WPSEC-2026-1541/
- https://plugins.svn.wordpress.org/give/tags/4.19.0.1/
- https://wordpress.org/plugins/give/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS