CVE-2026-118193: GiveWP <= 4.19.1 - Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter

Q: Which authenticated users should be considered capable of exploiting this issue?

Users with the GiveWP Manager role or higher who hold the manage_give_settings capability can exploit it. They can change GiveWP settings that control the WordPress role assigned to newly registered donors.

Q: Can an attacker assign the WordPress Administrator role to donors?

Yes, through the Tools › Import JSON path. That AJAX import handler writes imported settings directly to the give_settings option without invoking the sanitize filter, allowing Administrator to be configured as the donor role.

Q: Does every exploitation path allow assignment of Administrator?

No. The normal settings-save path blocks the literal Administrator role, but accepts other elevated roles such as Editor or Author. The JSON import path bypasses that restriction entirely.

Q: How can administrators assess whether the issue may already have been abused?

Review the configured donor default user role and investigate recent use of Tools › Import JSON. Review newly created donor accounts and their assigned WordPress roles, particularly for unexpected elevated roles or Administrator accounts.

Published Nov 5, 2026

Updated

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.19.1 via the donordefaultuserrole parameter. This is due to the sanitizeoptiondonordefaultuserrole() function applying only a narrow literal check against the string 'administrator' rather than enforcing the plugin's own givegetdonorsafeuserroles() allowlist on save, and due to the givecoresettingsimportcallback() AJAX handler writing imported JSON directly into the givesettings option via updateoption() without invoking the sanitize filter at all. This makes it possible for authenticated attackers with the GiveWP Manager role (holding the managegivesettings capability) and above to configure donor registration to assign privileged WordPress roles — up to and including Administrator via the import path — to every new donor account created through the platform. Via the settings save path, the Administrator role is blocked but any other elevated role (Editor, Author, etc.) is accepted; via the Tools › Import JSON path, the sanitize filter is bypassed entirely, allowing the Administrator role itself to be stored and subsequently applied to all newly registered donor accounts.

Event History

Nov 5, 2026

CVE Published

via MITRE·04:48 AM

Data Sourced

via MITRE·04:48 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:18 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which authenticated users should be considered capable of exploiting this issue?

Users with the GiveWP Manager role or higher who hold the manage_give_settings capability can exploit it. They can change GiveWP settings that control the WordPress role assigned to newly registered donors.

Can an attacker assign the WordPress Administrator role to donors?

Yes, through the Tools › Import JSON path. That AJAX import handler writes imported settings directly to the give_settings option without invoking the sanitize filter, allowing Administrator to be configured as the donor role.

Does every exploitation path allow assignment of Administrator?

No. The normal settings-save path blocks the literal Administrator role, but accepts other elevated roles such as Editor or Author. The JSON import path bypasses that restriction entirely.

How can administrators assess whether the issue may already have been abused?

Review the configured donor default user role and investigate recent use of Tools › Import JSON. Review newly created donor accounts and their assigned WordPress roles, particularly for unexpected elevated roles or Administrator accounts.

CVE-2026-118193: GiveWP <= 4.19.1 - Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter

Event History

Frequently Asked Questions

Which authenticated users should be considered capable of exploiting this issue?

Can an attacker assign the WordPress Administrator role to donors?

Does every exploitation path allow assignment of Administrator?

How can administrators assess whether the issue may already have been abused?

Company

Resources

Contact

Frequently Asked Questions

Which authenticated users should be considered capable of exploiting this issue?

Can an attacker assign the WordPress Administrator role to donors?

Does every exploitation path allow assignment of Administrator?

How can administrators assess whether the issue may already have been abused?