CVE-2026-11981: GiveWP CSRF Vulnerability Disables Donation Notifications

Technical summary

CVE-2026-11981 is a CSRF vulnerability (CWE-352) in the GiveWP WordPress plugin stemming from missing nonce validation in the give_set_notification_status_handler() function. The vulnerability requires user interaction—specifically, an authenticated administrator must be socially engineered into triggering the malicious request—but does not require the attacker to be authenticated. The attack vector is network-based with low complexity, resulting in integrity impact (modification of notification settings) with no confidentiality or availability consequences.

Business impact

For donation-dependent organizations using GiveWP, this vulnerability could lead to operational disruption by silencing critical donation confirmation emails. Donors may not receive receipts or acknowledgments, potentially damaging donor confidence and creating reconciliation headaches. While the financial transaction itself is not directly compromised, the loss of notification integrity could result in missed follow-up with donors, reduced trust, and indirect revenue impact through decreased repeat giving.

Affected systems

WordPress installations running the GiveWP plugin at version 4.15.3 or earlier are vulnerable. The attack surface is limited to sites where administrators may visit untrusted links or pages, and is most effective against organizations that do not implement standard browser security policies (e.g., SameSite cookie enforcement). Multi-site WordPress installations where an admin account is active could be targeted across multiple donation funnels simultaneously.

Exploitability

Exploitation requires social engineering of a WordPress administrator—a relatively common attack vector. An attacker would craft a malicious link or embed the attack in a webpage, relying on the administrator clicking it while logged into WordPress. The CVSS score of 4.3 (MEDIUM) reflects low attack complexity and no special privileges required, offset by the user interaction requirement. This is a practical attack that does not require technical sophistication or zero-day exploit code.

Remediation

Update the GiveWP plugin to a patched version beyond 4.15.3. Verify the available patch version against the official GiveWP GitHub repository or WordPress plugin directory. Additionally, enforce SameSite cookie policies at the WordPress configuration level to mitigate CSRF attacks more broadly, and educate administrators about phishing and malicious link risks.

Patch guidance

Navigate to WordPress Dashboard > Plugins, locate GiveWP, and check for updates. Patches addressing this vulnerability should be available in the plugin's update mechanism. Before deploying to production, test the update on a staging environment to verify compatibility with existing donation forms and custom workflows. Monitor donation notification logs after patching to confirm functionality is restored. Verify against the official GiveWP security advisories for the exact patched version number.

Detection guidance

Monitor WordPress logs and web server access logs for unusual request patterns targeting the give_set_notification_status_handler endpoint, particularly those originating from off-domain referrers. Check the GiveWP notification settings audit logs (if enabled) for unauthorized disable events. Implement SIEM rules to flag POST requests to the vulnerable endpoint with missing or invalid nonce parameters. Additionally, audit recent administrator browser history and email for suspicious links, especially those received around the time of notification settings changes.

Why prioritize this

Although rated MEDIUM severity, this vulnerability should be prioritized because it affects revenue-critical functionality (donation confirmations) and exploits a common attack vector (administrator social engineering). Organizations that depend on email notifications for donor stewardship and reconciliation face immediate operational risk. The ease of exploitation combined with the unavailability of workarounds (other than upgrading) warrants swift patching.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a network-accessible vulnerability with low attack complexity and required user interaction, resulting in integrity impact but no confidentiality or availability loss. The score appropriately captures that an attacker cannot directly compromise data or system availability, but can tamper with a critical business function. Context-specific risk is higher for donation-dependent organizations than for those using GiveWP for non-critical purposes.

Frequently asked questions