CVE-2026-111978 in GiveWP Plugin
Summary
by MITRE • 10/25/2026
The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk, allowing users with a high-privilege custom role to perform path traversal, disclose the contents of JSON-parseable files anywhere on the server, and overwrite the GiveWP WordPress plugin before 4.19.0.1's stored configuration.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified in versions of the GiveWP WordPress plugin prior to release 4.19.0.1 represents a critical failure in input validation mechanisms regarding file system operations. Specifically, the application fails to adequately sanitize or validate user-supplied filenames before utilizing them to read files from the local disk. This lack of rigorous checking allows an attacker who possesses a high-privilege custom role within the WordPress environment to manipulate the file path parameter. By injecting directory traversal sequences such as dot-dot-slash characters into the filename input, the attacker can bypass intended access controls and direct the application to access resources outside of the designated plugin directories. This flaw fundamentally undermines the principle of least privilege by allowing elevated users to interact with arbitrary files on the server's filesystem rather than being restricted to expected data structures or configuration files within the plugin's scope.
The operational impact of this vulnerability is severe, primarily due to its potential for information disclosure and configuration tampering. An attacker exploiting this path traversal flaw can read any file that is accessible by the web server process running WordPress. This includes sensitive JSON-parseable files which may contain database credentials, API keys, or other confidential data stored in plaintext or easily decodable formats across the entire server directory structure. Beyond mere disclosure, the vulnerability also permits the overwriting of the GiveWP plugin's own stored configuration files. By writing malicious content to these configuration files, an attacker can alter how the donation processing system operates, potentially redirecting funds, disabling security checks, or injecting further malware into the application logic. This dual capability of reading arbitrary data and modifying critical application settings significantly compromises the integrity and confidentiality of the web application and its underlying infrastructure.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes flaws where software does not properly neutralize special elements within file paths that can resolve to directories outside of the restricted directory. The exploitation technique involves manipulating input parameters to traverse parent directories, a common pattern in web application attacks targeting local file inclusion or reading mechanisms. In terms of tactical mapping under the MITRE ATT&CK framework for enterprise environments, this activity corresponds to T1083: File and Directory Discovery, where adversaries search for sensitive information on compromised systems. Furthermore, if the attacker utilizes the write capability to overwrite configuration files, it falls under T1562: Impair Defenses or potentially T1496: Resource Hijacking depending on the specific payload injected into the config file. These mappings highlight that while the root cause is a validation error, the resulting actions constitute active reconnaissance and defense evasion techniques aimed at maintaining persistence and extracting value from the compromised system.
Mitigation strategies must focus immediately on updating the GiveWP plugin to version 4.19.0.1 or later, where this input validation flaw has been addressed by developers implementing strict allow-listing of permitted characters for filenames and enforcing canonical path resolution before any file operations are executed. For organizations unable to patch immediately due to compatibility constraints, defensive measures should include restricting the web server user's permissions so that it cannot read sensitive system files or write to plugin configuration directories outside of expected paths. Additionally, implementing Web Application Firewall rules that detect common directory traversal patterns in request parameters can provide a layer of external protection against exploitation attempts. Regular auditing of custom role capabilities within WordPress is also recommended to ensure that high-privilege roles are assigned only to trusted administrators and that the principle of least privilege is strictly enforced across all user accounts interacting with the plugin's file handling features.