---
id: CVE-2026-111981
title: >-
  GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via
  donor_manage_addresses
summary: >-
  The GiveWP  WordPress plugin before 4.19.0.1 does not perform a capability
  check when handling donor address changes, allowing users who have been
  granted donor-report (view) access but not donor-edit access to add, modify,
  or delete the…
severity: none
cwe:
  - CWE-862
product: GiveWP
affected:
  - GiveWP < 4.19.0.1
published: '2026-10-25'
updated: '2026-10-25'
sourceUpdated: '2026-10-25T06:00:20.949Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111981'
references:
  - url: 'https://wpscan.com/vulnerability/9fae25ff-51e6-4137-83d6-e752374dae57/'
tags:
  - cve.org
epss: 0.00132
epssPercentile: 0.0277
ingestedAt: '2026-10-25T22:08:29.964Z'
---

## Overview

The GiveWP  WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report (view) access but not donor-edit access to add, modify, or delete the stored address of any donor on the site.

## Affected

- `GiveWP < 4.19.0.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.