GiveWP donation plugin lets donor accounts gain privileged roles
Donation plugin on WordPress sites lets insiders secretly gain higher access.
Summary
An authenticated account with the GiveWP Manager role or higher can set the GiveWP donation plugin to give new donor accounts privileged roles, including Administrator. All versions up to and including 4.19.1 are affected.
Affected when
- GiveWP Manager role or higher logged-in account
- GiveWP 4.19.1 or earlier
What to do
No fixed version is named. Check that the plugin is newer than 4.19.1 and read the vendor's advisory.
Products and platforms
CVE IDs
Times
First published
First seen