medium5.3
CVE-2026-111976
The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public front-end route, allowin…
Impact
The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public front-end route, allowing unauthenticated visitors to view the content and settings of unpublished (draft, pending, private and scheduled) donation forms that WordPress core otherwise keeps non-public.
Affected products
| Product | Affected versions |
|---|---|
| GiveWP WordPress Plugin | before 4.19.0.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.