{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/givewp--donation-plugin-and-fundraising-platform--4.19.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:givewp:givewp:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-118193"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["GiveWP – Donation Plugin and Fundraising Platform (\u003c= 4.19.1)"],"_cs_severities":["high"],"_cs_tags":["wordpress","privilege-escalation","web-application-security"],"_cs_type":"advisory","_cs_vendors":["GiveWP"],"content_html":"\u003cp\u003eGiveWP versions 4.19.1 and earlier are vulnerable to privilege escalation (CVE-2026-118193). The vulnerability stems from insufficient sanitization of the \u003ccode\u003edonor_default_user_role\u003c/code\u003e parameter within the plugin settings. Authenticated users with the \u003ccode\u003emanage_give_settings\u003c/code\u003e capability can exploit the \u003ccode\u003egive_core_settings_import_callback\u003c/code\u003e AJAX handler to bypass role allowlists, potentially assigning the Administrator role to new donor registrations. While direct setting modification attempts to block the Administrator role, the import mechanism fails to invoke the necessary sanitization filters.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated user with restricted administrative privileges (GiveWP Manager) to escalate the privileges of newly created donor accounts, potentially resulting in full administrative compromise of the WordPress installation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the GiveWP - Donation Plugin and Fundraising Platform to a version strictly newer than 4.19.1.\u003c/li\u003e\n\u003cli\u003eAudit existing donor registration settings and verify that the \u003ccode\u003edonor_default_user_role\u003c/code\u003e option is set to a restricted, non-privileged role.\u003c/li\u003e\n\u003cli\u003eReview WordPress user accounts for unexpected administrative privileges or unauthorized account creations originating from the GiveWP platform.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T06:28:31Z","date_published":"2026-11-05T06:28:31Z","id":"https://feed.craftedsignal.io/briefs/2026-11-givewp-privilege-escalation/","summary":"The GiveWP WordPress plugin (versions 4.19.1 and earlier) contains a privilege escalation flaw allowing attackers with administrative settings capabilities to assign arbitrary WordPress roles to new donor accounts.","title":"GiveWP: Privilege escalation vulnerability (CVE-2026-118193)","url":"https://feed.craftedsignal.io/briefs/2026-11-givewp-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - GiveWP – Donation Plugin and Fundraising Platform (\u003c= 4.19.1)","version":"https://jsonfeed.org/version/1.1"}