# CVE-2026-111980: GiveWP WordPress plugin authorization bypass in page capability

Source: https://junglewise.ai/threats/cve-2026-111980-the-givewp-wordpress-plugin-before-4-19-0-1-does-not-correctly  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-25. Updated: 2026-10-25  
License: CC BY 4.0 with a link back

CVE-2026-111980 · Severity: info · Published 2026-10-25

GiveWP is a donation and fundraising plugin for WordPress that manages charitable campaigns and donor interactions. A flaw in how the plugin validates page access permissions allows users with a custom fundraising role to edit, publish, and view pages they do not own, including administrator pages. An attacker with a fundraising role could modify campaign pages, alter donation content, or view sensitive administrative information.

Technologies: [GiveWP](https://junglewise.ai/threats/technologies/givewp-givewp). Vendors: [GiveWP](https://junglewise.ai/threats/vendors/givewp).

## Quick answers

**Is CVE-2026-111980 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111980 being exploited in the wild.

**How severe is CVE-2026-111980?** Informational severity, published 25 October 2026.

**Which products and versions are affected?** GiveWP before 4.19.0.1.

**Is there a fix for CVE-2026-111980?** Yes: fixed in 4.19.0.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111980 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-111980?** Check whether you run GiveWP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.19.0.1

## Technical details

The plugin fails to correctly validate which page a page-capability request applies to, resulting in broken access control (CWE-863). Users with a custom fundraising role can bypass authorization checks to edit, publish, and read pages owned by other users, including those owned by administrators. The vulnerability requires authentication with a fundraising role but affects all pages regardless of ownership.

## Affected products

- GiveWP GiveWP before 4.19.0.1

## Timeline

- 2026-10-23: disclosed
- 2026-10-25: advisory

## References

- [https://wpscan.com/vulnerability/7664c532-7a74-47de-8ae1-df4862067689/](https://wpscan.com/vulnerability/7664c532-7a74-47de-8ae1-df4862067689/)

## Related threats

- [GiveWP WordPress plugin donation amount restriction bypass](https://junglewise.ai/threats/cve-2026-111974-the-givewp-wordpress-plugin-before-4-19-0-1-does-not-restrict)
- [GiveWP WordPress plugin stored XSS in form template settings](https://junglewise.ai/threats/cve-2026-111979-the-givewp-wordpress-plugin-before-4-19-0-1-does-not-properly)
- [GiveWP WordPress plugin path traversal in settings import](https://junglewise.ai/threats/cve-2026-111978-the-givewp-wordpress-plugin-before-4-19-0-1-does-not-properly)
- [GiveWP WordPress plugin unpublished donation form disclosure](https://junglewise.ai/threats/cve-2026-111976-the-givewp-wordpress-plugin-before-4-19-0-1-does-not-perform-any)
- [GiveWP Insecure Direct Object References](https://junglewise.ai/threats/cve-2026-97066-unauthenticated-insecure-direct-object-references-idor-in-givewp)