CVE-2026-11981

Name of the Vulnerable Software and Affected Versions GiveWP versions prior to 4.15.4

Description The GiveWP plugin for WordPress contains a Cross-Site Request Forgery (CSRF) flaw. This occurs because the give set notification status handler() function fails to perform nonce validation. A nonce is a unique token used to ensure that a request was intentionally sent by the user. Consequently, unauthenticated attackers can disable donation email notifications by tricking a site administrator into clicking a malicious link.

Recommendations Update the plugin to version 4.15.4 or later. As a temporary mitigation, restrict administrative access to the WordPress dashboard to trusted networks.