Advisory · CVE-2026-118193
GiveWP settings import can hand new donors an administrator role
GiveWP up to and including 4.19.1 lets authenticated GiveWP Managers assign privileged WordPress roles to every new donor account, up to and including Administrator through the settings import path. Wordfence rates it CVSS 3.1 8.8.
- Vendor
- GiveWP
- Product
- GiveWP
- Identifier / CWE
- CVE-2026-118193
CWE-269 - Action timing
- Immediate
Explain it like I’m five
GiveWP lets managers choose which role new donors get, but the check only blocks the word 'administrator'. Through the import path there is no check at all, so every new donor can arrive as an admin.
- 01Manager with settings access
An authenticated attacker with the GiveWP Manager role holds the manage_give_settings capability.
- 02Role setting abused
The sanitize check for donor_default_user_role only blocks the literal string 'administrator', so other elevated roles pass on save.
- 03Import path skips the check
The settings import handler writes imported JSON directly into give_settings without invoking the sanitize filter at all.
- 04Admin donors created
The Administrator role is stored and applied to every newly registered donor account.
What happened
GiveWP up to and including 4.19.1 is vulnerable to privilege escalation through the donor_default_user_role parameter. The sanitize_option_donor_default_user_role() function applies only a narrow literal check against the string ‘administrator’ rather than enforcing the plugin’s own give_get_donor_safe_user_roles() allowlist on save, and the give_core_settings_import_callback() AJAX handler writes imported JSON directly into the give_settings option without invoking the sanitize filter at all. An authenticated attacker with the GiveWP Manager role can configure donor registration to assign privileged WordPress roles to every new donor account, up to and including Administrator via the import path.
Wordfence rates it CVSS 3.1 8.8 and identifies versions up to and including 4.19.1 as affected.
What to do
- Upgrade GiveWP to the latest release beyond 4.19.1 using the vendor’s guidance.
- While remediation is underway, limit who holds the GiveWP Manager role and the manage_give_settings capability.
- Review donor accounts created recently for unexpected privileged roles and remove or demote any that should not exist.
- Check give_settings for a donor_default_user_role outside the safe allowlist and reset it.
- Audit settings imports for unexpected role assignments.
Management note
A donation plugin that can mint administrator accounts is a site-takeover flaw with a fundraising wrapper. Review the donor user list, not just the plugin version, because the accounts it created do not disappear when the plugin is patched.