CVE-2026-111974: GiveWP < 4.19.0.1 - Unauthenticated Donation Amount Restriction Bypass via Currency
The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount limits as bare numbers, allowing unauthenticated users to make donations below a form's configured minimum or fixed amount.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GiveWPto a version that resolves this vulnerability.Fixed in 4.19.0.1
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated user who can submit a donation to an affected GiveWP form can exploit it. No account or user interaction is required.
Which donation forms are affected?
Forms with configured minimum donation amounts or fixed donation amounts are affected if they run a GiveWP version before 4.19.0.1. The issue arises when the submitted donation uses a currency other than the one accepted by the site or form.
How can I tell whether my site is vulnerable?
Check whether GiveWP is earlier than version 4.19.0.1 and whether donation forms enforce minimum or fixed amounts. Review donation records for submissions using unexpected currencies or amounts below the configured threshold when interpreted in the form's intended currency.
What can be done if updating is not immediately possible?
Restrict or disable affected donation forms, especially those using minimum or fixed amounts, until GiveWP can be updated. Monitor submitted donations for currencies not accepted by the site or individual form.