GiveWP CVE-2026-111976

Exploitation requires that at least one donation form exists in a non-public status (draft, pending, private, or scheduled) on a GiveWP installation older than 4.19.0.1, and that the attacker can reach the plugin's public front-end form-rendering route for that form (e.g., by referencing or enumerating its form ID/slug). No authentication, no user interaction, and no non-default configuration are required - the missing status/capability check applies to the standard front-end rendering path (PR:N/UI:N/AC:L). The practical limiting factors are that the target must actually have unpublished forms (a published-only site has nothing to leak) and that only form content and settings are disclosed - there is no write access or code execution, so impact is confined to confidentiality of otherwise-hidden form configuration.

This is a genuine but modest-severity information-disclosure issue rather than a high-urgency emergency, and the available signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3) describes a remotely reachable, unauthenticated, low-complexity flaw with only low confidentiality impact and no integrity or availability effect - matching the description of exposing non-public donation form content. Exploitation probability is low (EPSS 0.14%, 3rd percentile) and the flaw is NOT on CISA KEV, so there is no confirmed active exploitation. A public PoC reference exists (WPScan) but it is not verified as working exploit code, so PoC availability must not be conflated with in-the-wild use. The vuln.today decision label is 'this_month', consistent with a real-but-not-critical issue that should be remediated on a normal patch cadence. No SSVC automatable/technical-impact fields were supplied. The one thing to verify: the leaked data is limited to form content and settings (C:L), not credentials or PII beyond what the form configuration contains - confirm with the WPScan advisory whether any sensitive settings (e.g., gateway or email configuration) are among the exposed fields, as that would raise practical impact.

An unauthenticated visitor requests the public front-end route that renders a GiveWP donation form and references a form that is still in draft, pending, private, or scheduled status. Because the plugin performs no status or capability check before rendering, the visitor receives the content and settings of a form that WordPress core would otherwise keep non-public. A public PoC reference exists (WPScan) but is not verified as working exploit code; the low attack complexity (AC:L) means no special timing or preconditions are needed once the form route is known.