GiveWP: Privilege escalation vulnerability (CVE-2026-118193)

GiveWP versions 4.19.1 and earlier are vulnerable to privilege escalation (CVE-2026-118193). The vulnerability stems from insufficient sanitization of the donor_default_user_role parameter within the plugin settings. Authenticated users with the manage_give_settings capability can exploit the give_core_settings_import_callback AJAX handler to bypass role allowlists, potentially assigning the Administrator role to new donor registrations. While direct setting modification attempts to block the Administrator role, the import mechanism fails to invoke the necessary sanitization filters.

Impact

Successful exploitation allows an authenticated user with restricted administrative privileges (GiveWP Manager) to escalate the privileges of newly created donor accounts, potentially resulting in full administrative compromise of the WordPress installation.

Recommendation

• Update the GiveWP - Donation Plugin and Fundraising Platform to a version strictly newer than 4.19.1.
• Audit existing donor registration settings and verify that the donor_default_user_role option is set to a restricted, non-privileged role.
• Review WordPress user accounts for unexpected administrative privileges or unauthorized account creations originating from the GiveWP platform.