Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-111974

GiveWP < 4.19.0.1 - Unauthenticated Donation Amount Restriction Bypass via Currency

Description

The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount limits as bare numbers, allowing unauthenticated users to make donations below a form's configured minimum or fixed amount.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown GiveWP

Default version status: unaffected

  • 0 to < 4.19.0.1affected

References