Is CVE-2026-11981 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11981 being exploited in the wild.

How severe is CVE-2026-11981?

Medium severity, with a CVSS score of 4.3, published 1 July 2026.

Which products and versions are affected?

GiveWP GiveWP up to, and including, 4.15.3.

Is there a fix for CVE-2026-11981?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11981 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-11981?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11981: GiveWP CSRF in give_set_notification_status_handler

CVE-2026-11981 · Severity: medium · CVSS 4.3 · Published 2026-07-01

GiveWP is a popular WordPress plugin used by organizations to accept donations and manage fundraising campaigns. A security flaw allows an attacker to trick a site administrator into clicking a malicious link, which silently disables donation email notifications. This could lead to missed communications with donors and operational disruptions for non-profit organizations.

Quick answers

Is CVE-2026-11981 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11981 being exploited in the wild.
How severe is CVE-2026-11981?: Medium severity, with a CVSS score of 4.3, published 1 July 2026.
Which products and versions are affected?: GiveWP GiveWP up to, and including, 4.15.3.
Is there a fix for CVE-2026-11981?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11981 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-11981?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 4.15.3. The vulnerability is located in the give_set_notification_status_handler() function within the AJAX handler, which fails to perform proper nonce validation. An unauthenticated attacker can exploit this by crafting a malicious request and tricking a logged-in administrator into executing it (e.g., via social engineering or a malicious link). Successful exploitation allows the attacker to modify the status of donation email notifications, effectively disabling them. A patch appears to be available in the plugin's trunk/latest versions.

Affected products

GiveWP GiveWP up to, and including, 4.15.3

Timeline

2026-07-01: advisory: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.