GiveWP: Filename traversal exposes JSON files and overwrites configuration
GiveWP reads a user-supplied filename without adequate validation. A user with a high-privilege custom role can traverse paths to disclose JSON-parseable files anywhere on the server and overwrite the plugin’s stored configuration. The JSON-parseability restriction is part of the disclosed read primitive; unrestricted arbitrary-file disclosure or filesystem writes are not established. The exact role, file-reading endpoint and filename parameter are not disclosed in the export. Published affected versions: < 4.19.0.1.
- Component
- GiveWP
- Plugin slug
give- Affected
- < 4.19.0.1
- Safe version
4.19.0.1- Published
- Oct 25, 2026
- Weakness
- Not assigned
This CVE was published Oct 25, 2026 and is one of 69 known issues for this plugin.
Update, patch or deactivate.
Update GiveWP to 4.19.0.1 or later. Restrict resolved file paths to the intended trusted location, validate the imported configuration schema, and separately authorize configuration changes. Review configuration changes and assess sensitive JSON data that may have been disclosed.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk, allowing users with a high-privilege custom role to perform path traversal, disclose the contents of JSON-parseable files anywhere on the server, and overwrite the GiveWP WordPress plugin before 4.19.0.1's stored configuration.