GiveWP: Donor-report viewers can change any donor’s stored address
GiveWP does not check the required editing capability when processing donor-address changes. A user granted donor-report viewing access but not donor-edit access can add, modify or delete the stored address of any donor. Report-view permission is the disclosed prerequisite; this is not established for an arbitrary Subscriber. The handler, donor-ID parameter and address-field names are not disclosed in the export. Published affected versions: < 4.19.0.1.
- Component
- GiveWP
- Plugin slug
give- Affected
- < 4.19.0.1
- Safe version
4.19.0.1- Published
- Oct 25, 2026
- Weakness
- Not assigned
This CVE was published Oct 25, 2026 and is one of 69 known issues for this plugin.
Update, patch or deactivate.
Update GiveWP to 4.19.0.1 or later. Require donor-edit authorization for every address-changing operation, independently of report-view access. Review unexpected donor-address changes and minimize delegated report permissions.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report (view) access but not donor-edit access to add, modify, or delete the stored address of any donor on the site.