Junglewise Threat Intelligence

CVE-2026-11981: GiveWP CSRF in give_set_notification_status_handler

CVE-2026-11981 · Severity: medium · CVSS 4.3 · Published 2026-07-01

Vendors: GiveWP.

Executive brief

GiveWP is a popular WordPress plugin used by organizations to accept donations and manage fundraising campaigns. A security flaw allows an attacker to trick a site administrator into clicking a malicious link, which silently disables donation email notifications. This could lead to missed communications with donors and operational disruptions for non-profit organizations.

Technical details

The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 4.15.3. The vulnerability is located in the give_set_notification_status_handler() function within the AJAX handler, which fails to perform proper nonce validation. An unauthenticated attacker can exploit this by crafting a malicious request and tricking a logged-in administrator into executing it (e.g., via social engineering or a malicious link). Successful exploitation allows the attacker to modify the status of donation email notifications, effectively disabling them. A patch appears to be available in the plugin's trunk/latest versions.

Affected products

  • GiveWP GiveWP up to, and including, 4.15.3

Timeline

  • 2026-07-01: advisory: CVE published to NVD

References