GiveWP – Donation Plugin and Fundraising Platform <= 4.19.1 - Authenticated (Give Manager+) Privilege Escalation via Donor Default User Role Setting
- ID
- WPSEC-2026-2515
- Plugin
- GiveWP – Donation Plugin and Fundraising Platform (give)
- Affected
- all versions before 4.19.1.1
- Remediation
- Update to 4.19.1.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-269
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-04
- Attack surface
- GiveWP – Donation Plugin and Fundraising Platform on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-118193, on 2026-11-04.
Description
The GiveWP plugin for WordPress is vulnerable to Privilege Escalation via the 'donor_default_user_role' setting in all versions up to, and including, 4.19.1. This is due to insufficient validation of the configured role: the sanitizer only blocked the 'administrator' role for users without the manage_options capability, and the stored value was used without a capability check when donation forms created new WordPress users. This makes it possible for authenticated attackers with access to GiveWP settings, such as a Give Manager, to set the donor default role to another privileged role and obtain, or grant, accounts with privileges beyond their own.
References
- https://wpsec.com/vuln/WPSEC-2026-2515/
- https://plugins.svn.wordpress.org/give/tags/4.19.1.1/
- https://wordpress.org/plugins/give/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS