---
id: CVE-2026-111981
title: >-
  GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via
  donor_manage_addresses
summary: >-
  The GiveWP  WordPress plugin before 4.19.0.1 does not perform a capability
  check when handling donor address changes, allowing users who have been
  granted donor-report (view) access but not donor-edit access to add, modify,
  or delete the…
severity: low
cvss: 2.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-862
product: GiveWP
affected:
  - GiveWP < 4.19.0.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-26T10:07:51.987787Z'
published: '2026-10-25'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T10:13:37.251Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111981'
references:
  - url: 'https://wpscan.com/vulnerability/9fae25ff-51e6-4137-83d6-e752374dae57/'
tags:
  - cve.org
epss: 0.00168
epssPercentile: 0.06128
ingestedAt: '2026-10-25T22:08:29.964Z'
---

## Overview

The GiveWP  WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report (view) access but not donor-edit access to add, modify, or delete the stored address of any donor on the site.

## Affected

- `GiveWP < 4.19.0.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.