CVE-2026-111976: GiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View Route

Q: Who can exploit this issue?

Any unauthenticated visitor can exploit it because the affected public front-end route does not enforce form status or capability checks.

Q: Which donation forms may be exposed?

Unpublished donation forms in draft, pending, private, or scheduled status may be disclosed. The exposed information includes the forms' content and settings.

Q: Are publicly available donation forms the only concern?

No. The issue specifically exposes forms that WordPress core would normally keep non-public, provided the site is running GiveWP before 4.19.0.1.

Published Oct 25, 2026

Updated

The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public front-end route, allowing unauthenticated visitors to view the content and settings of unpublished (draft, pending, private and scheduled) donation forms that WordPress core otherwise keeps non-public.

Affected Software

1 affected component

GiveWP GiveWP<4.19.0.1

Event History

Oct 25, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated visitor can exploit it because the affected public front-end route does not enforce form status or capability checks.

Which donation forms may be exposed?

Unpublished donation forms in draft, pending, private, or scheduled status may be disclosed. The exposed information includes the forms' content and settings.

Are publicly available donation forms the only concern?

No. The issue specifically exposes forms that WordPress core would normally keep non-public, provided the site is running GiveWP before 4.19.0.1.

CVE-2026-111976: GiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View Route

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Which donation forms may be exposed?

Are publicly available donation forms the only concern?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which donation forms may be exposed?

Are publicly available donation forms the only concern?