# GiveWP <= 4.19.0 - Unauthenticated Information Exposure of Unpublished Donation Forms

- **ID:** WPSEC-2026-1541
- **Plugin:** GiveWP – Donation Plugin and Fundraising Platform (`give`), https://wordpress.org/plugins/give/
- **Affected versions:** from 3.0.0 before 4.19.0.1
- **Fixed in:** 4.19.0.1 (Update to 4.19.0.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-23)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/give
- **Fix released:** 2026-10-22
- **Published:** 2026-10-23
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1541/

## Description

The GiveWP plugin for WordPress is vulnerable to Information Exposure via the donation-form-view and donation-form-view-preview routes in versions 3.0.0 up to, and including, 4.19.0, due to the routes rendering any donation form by ID without checking that it is published or that the user may view private forms. This makes it possible for unauthenticated attackers to view the content of draft and private donation forms.

## References

- https://wpsec.com/vuln/WPSEC-2026-1541/
- https://plugins.svn.wordpress.org/give/tags/4.19.0.1/
- https://wordpress.org/plugins/give/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1541/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.