{"id":"CVE-2026-111981","published":"2026-10-25T06:16:31.597","lastModified":"2026-10-26T13:50:14.083","description":"The GiveWP  WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report (view) access but not donor-edit access to add, modify, or delete the stored address of any donor on the site.","cvssScore":2.7,"cvssSeverity":"LOW","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/9fae25ff-51e6-4137-83d6-e752374dae57/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}