What is the CVSS score of CVE-2026-11981?

CVE-2026-11981 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

GiveWP CVE-2026-11981

EUVD-2026-40905 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-01 Wordfence

GHSA-7jgp-xppm-6ff3

WordPress CSRF Wordpress Plugin Givewp Donation Plugin And Fundraising Platform Stellarwp

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable CSRF with no attacker privileges, but admin click required (UI:R); impact confined to toggling a notification setting (I:L), no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 05:33 vuln.today

CVE Published

Jul 01, 2026 - 04:32 nvd

MEDIUM 4.3

DescriptionCVE.org

The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.15.3 This is due to missing nonce validation on the give_set_notification_status_handler() function. This makes it possible for unauthenticated attackers to disable donation email notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in GiveWP - Donation Plugin and Fundraising Platform (versions up to and including 4.15.3) allows unauthenticated remote attackers to disable donation email notifications by tricking a logged-in administrator into clicking a crafted link. The root cause is absent nonce validation in the give_set_notification_status_handler() AJAX handler, permitting forged state-changing requests. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; however, the integrity impact - silently disabling donation notifications - could cause operational blind spots for nonprofit or fundraising site operators.

Technical ContextAI

GiveWP (CPE: cpe:2.3:a:stellarwp:givewp_-_donation_plugin_and_fundraising_platform:*:*:*:*:*:*:*:*) is a WordPress plugin by StellarWP used for managing donation campaigns and fundraising. The vulnerable code resides in includes/admin/emails/ajax-handler.php, specifically the give_set_notification_status_handler() function (visible at lines 24, 25, and 32 of the 4.15.3 tag). This function handles AJAX requests to toggle donation email notification states but fails to verify a WordPress nonce before acting, violating the standard WordPress security pattern for admin AJAX handlers. CWE-352 (Cross-Site Request Forgery) is the root cause class: the server trusts the authenticated session cookie without requiring proof that the request originated from the legitimate admin interface. A Trac changeset reference between tags 4.15.3 and 4.15.4 indicates that nonce validation was introduced as the remediation.

RemediationAI

Upgrade GiveWP to version 4.15.4 or later; this is inferred as the patched release from the Trac changeset diff between tags 4.15.3 and 4.15.4 (https://plugins.trac.wordpress.org/changeset?old_path=%2Fgive/tags/4.15.3&new_path=%2Fgive/tags/4.15.4), though the exact fix version has not been independently confirmed via a formal vendor security advisory. Update via the WordPress admin dashboard under Plugins > Installed Plugins > GiveWP > Update, or through WP-CLI with wp plugin update give. If an immediate upgrade is not feasible, a compensating control is to restrict access to WordPress admin-ajax.php endpoints at the web server or WAF layer for unauthenticated or non-administrator origins, though this may interfere with other plugin AJAX functionality. Wordfence users with an active license may have virtual patching available via their firewall rules. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/49954c72-df0d-46ec-a252-8af84dea41bf?source=cve for updated vendor confirmation.