# GiveWP – Donation Plugin and Fundraising Platform <= 4.19.1 - Authenticated (Subscriber+) Insecure Direct Object Reference via Donation Form Email

- **ID:** WPSEC-2026-2516
- **Plugin:** GiveWP – Donation Plugin and Fundraising Platform (`give`), https://wordpress.org/plugins/give/
- **Affected versions:** all versions before 4.19.1.1
- **Fixed in:** 4.19.1.1 (Update to 4.19.1.1 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/give
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2516/

## Description

The GiveWP plugin for WordPress is vulnerable to Insecure Direct Object Reference via the donor email field on donation forms in all versions up to, and including, 4.19.1. This is due to the plugin allowing logged-in users to submit a donation with any email address not already owned by another donor and automatically appending that address to their own donor record's additional emails. This makes it possible for authenticated attackers with subscriber-level access and above to claim email addresses belonging to other people, causing later donations made with that email to be associated with the attacker's donor record and potentially exposing related donation history or receipts.

## References

- https://wpsec.com/vuln/WPSEC-2026-2516/
- https://plugins.svn.wordpress.org/give/tags/4.19.1.1/
- https://wordpress.org/plugins/give/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2516/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.