GiveWP <= 4.19.1 - Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter

Overview

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.19.1 via the donor_default_user_role parameter. This is due to the sanitize_option_donor_default_user_role() function applying only a narrow literal check against the string 'administrator' rather than enforcing the plugin's own give_get_donor_safe_user_roles() allowlist on save, and due to the give_core_settings_import_callback() AJAX handler writing imported JSON directly into the give_settings option via update_option() without invoking the sanitize filter at all. This makes it possible for authenticated attackers with the GiveWP Manager role (holding the manage_give_settings capability) and above to configure donor registration to assign privileged WordPress roles — up to and including Administrator via the import path — to every new donor account created through the platform. Via the settings save path, the Administrator role is blocked but any other elevated role (Editor, Author, etc.) is accepted; via the Tools › Import JSON path, the sanitize filter is bypassed entirely, allowing the Administrator role itself to be stored and subsequently applied to all newly registered donor accounts.

Affected

• givewp_donation_plugin_and_fundraising_platform <= 4.19.1

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.