Vulnerability · Published Oct 26, 2026 · Assigned by WPScan
CVE-2026-111974GiveWP < 4.19.0.1 - Unauthenticated Donation Amount Restriction Bypass via Currency
Medium 5.3
In plain English
A medium-severity improper input validation in GiveWP from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 90.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount limits as bare numbers, allowing unauthenticated users to make donations below a form's configured minimum or fixed amount.
Affected products (as reported)
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/2d7c0c89-7f0e-4f2b-908f-7d96e1d8a228/ exploit, vdb-entry, technical-description