GiveWP: Fundraising role bypasses cross-user page permissions
GiveWP incorrectly resolves which page a page-capability request applies to. A user with a custom fundraising role can use the resulting authorization error to edit, publish and read pages owned by other users, including administrators. The exact role name, capability request and page-ID handling function are not disclosed in the export; this does not establish administrator impersonation. Published affected versions: < 4.19.0.1.
- Component
- GiveWP
- Plugin slug
give- Affected
- < 4.19.0.1
- Safe version
4.19.0.1- Published
- Oct 25, 2026
- Weakness
- Not assigned
This CVE was published Oct 25, 2026 and is one of 69 known issues for this plugin.
Update, patch or deactivate.
Update GiveWP to 4.19.0.1 or later. Resolve and authorize the actual target page for each read, edit or publish request, respecting ownership and status. Review cross-user page access and changes made by custom fundraising roles.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users with a custom fundraising role to edit, publish and read pages owned by other users, including administrators.