# GiveWP – Donation Plugin and Fundraising Platform <= 4.19.1 - Authenticated (Give Manager+) Privilege Escalation via Donor Default User Role Setting

- **ID:** WPSEC-2026-2515
- **Plugin:** GiveWP – Donation Plugin and Fundraising Platform (`give`), https://wordpress.org/plugins/give/
- **Affected versions:** all versions before 4.19.1.1
- **Fixed in:** 4.19.1.1 (Update to 4.19.1.1 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-269
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/give
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2515/

## Description

The GiveWP plugin for WordPress is vulnerable to Privilege Escalation via the 'donor_default_user_role' setting in all versions up to, and including, 4.19.1. This is due to insufficient validation of the configured role: the sanitizer only blocked the 'administrator' role for users without the manage_options capability, and the stored value was used without a capability check when donation forms created new WordPress users. This makes it possible for authenticated attackers with access to GiveWP settings, such as a Give Manager, to set the donor default role to another privileged role and obtain, or grant, accounts with privileges beyond their own.

Also published later by wordfence as CVE-2026-118193.

## References

- https://wpsec.com/vuln/WPSEC-2026-2515/
- https://plugins.svn.wordpress.org/give/tags/4.19.1.1/
- https://wordpress.org/plugins/give/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2515/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.