GiveWP 4.19.1 and earlier lets a settings import set Administrator as the default donor role (CVE-2026-118193)
Identifiers: CVE-2026-118193
- Published
- Last substantive change
- Last verified
Last verified: . Attention items are due for re-verification within 72 hours.
Summary
In GiveWP 4.19.1 and earlier, the normal settings screen blocks Administrator as the default donor role but allows other elevated roles such as Editor. The Tools > Import JSON path bypasses that validation, so an authenticated user with the manage_give_settings capability can set Administrator as the default role for donors who register afterwards.
Impact
New donor accounts could be created with Administrator rights, giving full site control to anyone who registers. Existing donors are not promoted retroactively. The actor needs manage_give_settings, which belongs to GiveWP Manager or higher by default; custom role assignments may widen who holds it.
Who is affected
WordPress sites running GiveWP 4.19.1 or earlier. The issue requires an authenticated account that holds the manage_give_settings capability, whoever that account belongs to.
Products and versions
| Products and versions | Affected | Fixed |
|---|---|---|
| GiveWP | <= 4.19.1 | 4.19.1.1 |
Exploitation evidence
Exploitation not established. The reviewed records do not establish exploitation in the wild.
Actions
- After backup and compatibility checks, update to 4.19.1.1 or a newer patched release.
- Review which accounts hold manage_give_settings and remove it where it is not needed.
- Check the donor default role setting and any recent settings imports.
- Examine privileged accounts created recently, because the patch does not audit accounts created earlier.
- Confirm that a new test registration you control receives the intended low-privilege role.
Unknowns
- Exploitation in the wild is not established by the reviewed records.
- Whether a particular site's settings were already changed cannot be determined from the advisory.
Sources
- Wordfence CNA / CVE Program https://cveawg.mitre.org/api/cve/CVE-2026-118193
- GiveWP / WordPress.org https://plugins.svn.wordpress.org/give/trunk/readme.txt
Change history
- — Published: GiveWP 4.19.1 and earlier lets a user with manage_give_settings import settings that make new donors Administrators; update to 4.19.1.1 or newer and review roles.