CVE-2026-111981

The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report view access but not donor-edit access to add, modify, or delete the stored address of any donor on the site...

CVE-2026-111981

The GiveWP WordPress plugin versions prior to 4.19.0.1 is vulnerable to an authorization bypass because it fails to perform an adequate capability check when handling donor address changes. This allows users with donor-report (view) access, but lacking donor-edit permissions, to add, modify, or d...

CVE-2026-111981 GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_addresses

The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report view access but not donor-edit access to add, modify, or delete the stored address of any donor on the site...