Urgent: Privilege Escalation Vulnerability in GiveWP (CVE-2026-118193)

What is Affected and How Serious It Is

A significant privilege escalation vulnerability, identified as CVE-2026-118193, has been discovered in the GiveWP – Donation Plugin and Fundraising Platform for WordPress. This vulnerability affects all versions of the plugin up to, and including, 4.19.1. Given that GiveWP powers over 100,000 active WordPress installations, this flaw presents a substantial security risk to a large number of websites globally.

The core of this vulnerability lies in two distinct but related issues concerning how user roles are assigned and how plugin settings are handled. Firstly, the sanitize_option_donor_default_user_role() function, which is intended to sanitize the donor_default_user_role parameter, applies only a narrow literal check against the string 'administrator'. This means it fails to properly enforce the plugin's own give_get_donor_safe_user_roles() allowlist during the saving of settings. While this path generally blocks the direct assignment of the Administrator role, it still permits other elevated roles such as Editor or Author to be assigned to new donor accounts.

Secondly, and more critically, the give_core_settings_import_callback() AJAX handler is vulnerable. This handler is responsible for importing JSON data directly into the give_settings option via update_option() without adequately invoking the necessary sanitize filter. This bypass of the sanitization process is particularly dangerous because it allows the Administrator role itself to be stored and subsequently applied to all newly registered donor accounts through the 'Tools › Import JSON' path.

The severity of CVE-2026-118193 is rated as High, with a CVSS score of 8.8. This is due to the potential for authenticated attackers, specifically those holding the GiveWP Manager role (which includes the manage_give_settings capability) or any role above it, to manipulate these settings. By doing so, they can configure donor registration to automatically assign highly privileged WordPress roles—up to and including Administrator—to every new donor account created through the platform. This could grant an attacker full control over the affected WordPress site, compromising its confidentiality, integrity, and availability. While there is no public evidence to suggest this vulnerability is currently being actively exploited in the wild, the potential impact and ease of exploitation for an authenticated attacker with specific permissions make this a critical issue that requires immediate attention.

For more details, you can refer to the National Vulnerability Database (NVD) record: https://nvd.nist.gov/vuln/detail/CVE-2026-118193.

Need it patched now? A senior engineer (20+ years in production PHP) applies the fix, updates safely and checks checkout, login and forms afterwards, within 24–48 hours, no meetings. One-time $99. Queue an emergency fix → · Want this handled every month? WordPress care plan →

How to Check If Your Site Is Exposed

Identifying whether your WordPress site is exposed to CVE-2026-118193 primarily involves verifying your GiveWP plugin version and, if necessary, reviewing system configurations and logs.

1. Check Your GiveWP Plugin Version:

The most straightforward way to determine exposure is to check the version of your GiveWP plugin. All versions up to, and including, 4.19.1 are vulnerable. The vulnerability is fixed in version 4.19.1.1.

• Via WordPress Admin Dashboard:

  1. Log in to your WordPress admin area.
  2. Navigate to Plugins > Installed Plugins.
  3. Locate "GiveWP – Donation Plugin and Fundraising Platform" in the list.
  4. The version number will be displayed next to the plugin name. If it is 4.19.1 or earlier, your site is vulnerable.

• Via WP-CLI (for advanced users):

  1. Access your server via SSH.
  2. Navigate to your WordPress installation root directory.
  3. Run the command: wp plugin list --fields=name,version --status=active | grep give
  4. This will display the name and version of the active GiveWP plugin.

• Via File System:

  1. Connect to your server using an FTP client or file manager.
  2. Navigate to wp-content/plugins/give/.
  3. Open the readme.txt file or give.php file (the main plugin file) and look for the "Version:" header.

2. Review User Roles and Capabilities:

While not a direct check for the vulnerability's presence, reviewing user roles can help assess the potential impact if an attacker exploited the flaw.

• Navigate to Users > All Users in your WordPress admin.
• Identify any users with the "GiveWP Manager" role or any other custom roles that might include the manage_give_settings capability. These are the roles an attacker would need to exploit this vulnerability.

3. Check Activity Logs and Database (Post-Compromise Indicators):

If you have an activity log plugin (e.g., WP Activity Log, Stream, or security plugins like Wordfence/Sucuri that offer logging features), you can review logs for suspicious activity.

• Changes to GiveWP Settings: Look for unusual modifications to GiveWP settings, especially around the donor_default_user_role option or any give_settings updates.
• Suspicious AJAX Calls: Monitor server access logs for repeated or unusual POST requests to wp-admin/admin-ajax.php with the action=give_core_settings_import_callback parameter. This could indicate an attacker attempting to exploit the import path.
• New Administrator Accounts: If the vulnerability has been exploited, you might find newly registered user accounts with Administrator privileges that appear to be donor accounts, created through the GiveWP platform.

It is important to note that the absence of log entries does not guarantee your site is not exposed; it merely means exploitation might not have occurred or gone undetected by your current logging setup. The most definitive check is always the plugin version.

Immediate Mitigation If You Cannot Update Today

While updating to the patched version is the most effective solution, there might be situations where an immediate update is not feasible. In such cases, these steps can help mitigate the risk, but they are not a substitute for applying the security patch.

1. Restrict Access to GiveWP Manager Role and Capabilities: The vulnerability requires an authenticated attacker with the manage_give_settings capability, typically held by users with the "GiveWP Manager" role or higher.

• Review User Permissions: Go to Users > All Users in your WordPress admin. Carefully review all users and their assigned roles.
• Principle of Least Privilege: Ensure that only highly trusted and essential administrators have roles that grant the manage_give_settings capability. If a user does not absolutely need to manage GiveWP settings, temporarily downgrade their role or remove this specific capability.
• Custom Roles: If you use custom roles, verify that none of them inadvertently grant the manage_give_settings capability to non-administrative users.

2. Implement Web Application Firewall (WAF) Rules: If your hosting environment or site uses a Web Application Firewall (WAF) such as Wordfence, Cloudflare, or Sucuri, you may be able to implement custom rules to block suspicious activity.

• Block AJAX Import Path: Configure your WAF to block or strictly limit access to wp-admin/admin-ajax.php when the action parameter is give_core_settings_import_callback, especially from untrusted IP addresses or for users who are not logged in as a full administrator. This targets the bypass mechanism that allows Administrator role assignment.
• Monitor for donor_default_user_role Changes: While more complex, some advanced WAFs might be configured to detect and block attempts to modify the donor_default_user_role setting if it's being set to a highly privileged role, particularly when accessed by non-administrator users. This requires careful implementation to avoid false positives and disrupting legitimate functionality.

3. Enhance Security Logging and Monitoring: Increase the verbosity of your security logs and actively monitor them for any signs of exploitation.

• Look for failed login attempts, unexpected user registrations, or changes to critical plugin settings.
• Set up alerts for any new user accounts created with administrative privileges.

Remember, these mitigations are temporary measures. The fundamental fix requires updating the GiveWP plugin.

How to Update Safely

Updating plugins, especially security-critical ones, is a standard and essential maintenance task for any WordPress site. To ensure a smooth process and minimize any potential disruption, follow these best practices for safe updating.

1. Backup Your Entire Website: This is the most crucial step before any update. A complete backup allows you to restore your site to its previous state if something goes wrong.

• Full Backup: Create a full backup of both your WordPress files (including wp-content, themes, plugins, and uploads) and your database.
• Methods: Use your hosting provider's backup tools, a reputable WordPress backup plugin (e.g., UpdraftPlus, Duplicator), or perform manual backups via FTP/SFTP and phpMyAdmin.
• Verify Backup: Confirm that your backup files are complete and can be successfully restored.

2. Use a Staging Environment: Never update a production site directly without testing the update first.

• Create a Staging Site: Most reputable hosting providers offer one-click staging environment creation. Alternatively, you can manually clone your live site to a separate staging domain or subdomain.
• Update on Staging: On your staging site, update the GiveWP – Donation Plugin and Fundraising Platform to the latest available version (4.19.1.1 or higher).
• Thorough Testing: After updating on the staging site, meticulously test all critical functionalities:
  • Donation Forms: Submit donations through all your active forms to ensure they process correctly.
  • Donor Registration: Test the donor registration process to confirm that new accounts are created with the intended default user role (e.g., "Subscriber" or "Donor," not an elevated role).
  • Admin Settings: Navigate through the GiveWP settings pages in the WordPress admin to ensure all configurations load and save correctly.
  • Other Website Functionality: Check other parts of your website to ensure the update has not introduced any conflicts with your theme or other plugins.

3. Update Your Live Site: If all tests on your staging environment are successful, you can proceed with updating your live site.

• Perform Update: Go to Plugins > Installed Plugins in your live WordPress admin, locate GiveWP, and click "Update Now." The fixed version is 4.19.1.1.
• Clear Caches: After the update, clear any caching layers you have in place (plugin caches, server-level caches, CDN caches) to ensure the updated code is served to visitors.
• Final Verification: Perform a quick check of your live site's critical functionalities, similar to your staging site tests, to confirm everything is working as expected.

4. Check Vendor Advisories: Always refer to the official GiveWP changelog or security advisories for any specific post-update instructions or additional recommendations. The GiveWP 4.19.1.1 changelog specifically mentions the security fix for the donor default user role setting. Staying informed directly from the vendor is crucial for long-term security.

Checklist

Addressing the CVE-2026-118193 vulnerability in GiveWP requires a systematic approach. Use this checklist to ensure all necessary steps are covered.

• Identify the exact version of the GiveWP – Donation Plugin and Fundraising Platform running on all your WordPress sites.
• Verify if your GiveWP version is 4.19.1 or earlier, indicating vulnerability to CVE-2026-118193.
• Review all user accounts with the manage_give_settings capability (typically the GiveWP Manager role or higher) and restrict access to only trusted administrators.
• Create a full backup of your WordPress site, including both files and database, before proceeding with any updates.
• If available, deploy and test the update on a staging environment first to identify any potential conflicts or issues.
• Update the GiveWP – Donation Plugin and Fundraising Platform to the latest available version (4.19.1.1 or higher), which contains the patch for CVE-2026-118193.
• Thoroughly test key GiveWP functionalities on your updated site, such as donation forms, donor registration, and plugin settings, to ensure proper operation.
• Clear all site caches (plugin, server, CDN) after the update.
• Monitor your site's activity logs and security logs for any unusual behavior, new administrator accounts, or failed login attempts post-update.
• Consult the official GiveWP changelog or security advisories for any further recommendations or specific instructions related to this vulnerability.