# CVE-2026-111978: GiveWP WordPress plugin path traversal in settings import

Source: https://junglewise.ai/threats/cve-2026-111978-the-givewp-wordpress-plugin-before-4-19-0-1-does-not-properly  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-25. Updated: 2026-10-25  
License: CC BY 4.0 with a link back

CVE-2026-111978 · Severity: info · Published 2026-10-25

GiveWP is a popular WordPress plugin used to create and manage donation functionality on websites. A flaw in the plugin's settings import feature allows users with high-privilege custom roles to read arbitrary JSON files from the server and overwrite the plugin's configuration, potentially exposing sensitive data or disrupting donation systems.

Technologies: [GiveWP](https://junglewise.ai/threats/technologies/givewp-givewp). Vendors: [GiveWP](https://junglewise.ai/threats/vendors/givewp).

## Quick answers

**Is CVE-2026-111978 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111978 being exploited in the wild.

**How severe is CVE-2026-111978?** Informational severity, published 25 October 2026.

**Which products and versions are affected?** GiveWP before 4.19.0.1.

**Is there a fix for CVE-2026-111978?** Yes: fixed in 4.19.0.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111978 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-111978?** Check whether you run GiveWP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.19.0.1

## Technical details

The GiveWP plugin fails to properly validate user-supplied filenames in the settings import functionality, enabling CWE-22 path traversal attacks. Users with a high-privilege custom role (but not necessarily administrators) can exploit this to access and read JSON-parseable files anywhere on the server filesystem and potentially overwrite the plugin's configuration. No authentication bypass is required; the vulnerability requires an authenticated attacker with elevated custom role privileges.

## Affected products

- GiveWP GiveWP before 4.19.0.1

## Timeline

- 2026-10-23: disclosed: Publicly published on WPScan
- 2026-10-25: advisory: CVE-2026-111978 published

## References

- [https://wpscan.com/vulnerability/ab77a13e-491e-47a9-a50d-839a8ad341aa/](https://wpscan.com/vulnerability/ab77a13e-491e-47a9-a50d-839a8ad341aa/)

## Related threats

- [GiveWP WordPress plugin donation amount restriction bypass](https://junglewise.ai/threats/cve-2026-111974-the-givewp-wordpress-plugin-before-4-19-0-1-does-not-restrict)
- [GiveWP WordPress plugin authorization bypass in page capability](https://junglewise.ai/threats/cve-2026-111980-the-givewp-wordpress-plugin-before-4-19-0-1-does-not-correctly)
- [GiveWP WordPress plugin stored XSS in form template settings](https://junglewise.ai/threats/cve-2026-111979-the-givewp-wordpress-plugin-before-4-19-0-1-does-not-properly)
- [GiveWP WordPress plugin unpublished donation form disclosure](https://junglewise.ai/threats/cve-2026-111976-the-givewp-wordpress-plugin-before-4-19-0-1-does-not-perform-any)
- [GiveWP Insecure Direct Object References](https://junglewise.ai/threats/cve-2026-97066-unauthenticated-insecure-direct-object-references-idor-in-givewp)