CVE-2026-11981 Overview
CVE-2026-11981 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the GiveWP donation plugin for WordPress in versions up to and including 4.15.3. The flaw exists in the give_set_notification_status_handler() function, which fails to perform nonce validation before processing state-changing requests. Unauthenticated attackers can craft a malicious link or page that, when visited by an authenticated site administrator, disables donation email notifications on the target site. Exploitation requires user interaction, but the outcome undermines revenue-critical alerting for nonprofits and fundraisers relying on GiveWP. The issue is tracked as CWE-352 and was resolved in GiveWP 4.15.4.
Critical Impact
Attackers can silently disable donation email notifications on affected WordPress sites by tricking an administrator into clicking a crafted link, disrupting donation confirmation and record-keeping workflows.
Affected Products
- GiveWP plugin for WordPress, versions up to and including 4.15.3
- WordPress sites using the vulnerable ajax-handler.php email notification handler
- Fixed in GiveWP 4.15.4
Discovery Timeline
- 2026-07-01 - CVE-2026-11981 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-11981
Vulnerability Analysis
The GiveWP plugin exposes an AJAX endpoint that toggles the status of donation email notifications through the give_set_notification_status_handler() function defined in includes/admin/emails/ajax-handler.php. The handler processes incoming requests to enable or disable notification categories without verifying a WordPress nonce token. Because WordPress relies on nonces to prove that a state-changing request originated from a legitimate administrative UI action, the missing check allows any cross-origin request carrying the administrator's session cookies to succeed.
An attacker who hosts a malicious page containing an auto-submitting form or image tag pointed at the vulnerable endpoint can force the browser of a logged-in administrator to issue the request. The server processes the change under the administrator's authority. The result is silent modification of the notification settings, breaking donation receipts, admin alerts, and donor confirmation emails without triggering credential prompts or visible errors.
Root Cause
The root cause is missing CSRF protection [CWE-352]. The vulnerable handler in ajax-handler.php at lines 24, 25, and 32 accepts request parameters and updates notification state without calling check_ajax_referer() or wp_verify_nonce(). The fix delivered in changeset 3573301 and shipped in version 4.15.4 introduces nonce validation before the state change executes.
Attack Vector
Exploitation is network-based and requires user interaction from a privileged WordPress user, typically an administrator with capability to manage GiveWP settings. The attacker crafts a link, embedded image, or hidden form that targets the vulnerable AJAX endpoint and delivers it via phishing email, forum post, comment, or watering-hole page. When the authenticated administrator loads the attacker-controlled content in the same browser session used for WordPress administration, the forged request executes and disables the targeted email notifications.
No verified public exploit code is available. See the Wordfence Vulnerability Analysis and the WordPress Changeset 3573301 for the code-level diff.
Detection Methods for CVE-2026-11981
Indicators of Compromise
- Unexpected changes to GiveWP notification status settings visible in the WordPress admin dashboard under Donations → Settings → Emails.
- Sudden absence of donation receipts, admin donation alerts, or new donor welcome emails without a corresponding configuration change entry.
- HTTP POST requests to the GiveWP AJAX endpoint invoking the give_set_notification_status action originating from external Referer headers.
- Administrator sessions generating notification-toggle requests immediately after visiting third-party sites or clicking external links.
Detection Strategies
- Inspect web server access logs for requests to admin-ajax.php with the action=give_set_notification_status parameter and cross-reference the Referer header against expected admin origins.
- Enable WordPress audit logging plugins to record GiveWP settings changes with timestamp, user, and source IP for forensic review.
- Compare current GiveWP email notification configuration against a known-good baseline on a scheduled cadence.
Monitoring Recommendations
- Alert on any modification to GiveWP notification settings outside approved change windows.
- Monitor for phishing campaigns targeting site administrators of nonprofit and donation platforms.
- Track the GiveWP plugin version deployed across managed WordPress instances and flag any host still running 4.15.3 or earlier.
How to Mitigate CVE-2026-11981
Immediate Actions Required
- Update the GiveWP plugin to version 4.15.4 or later on every affected WordPress site.
- Audit current email notification settings in GiveWP and restore any that were disabled without authorization.
- Instruct WordPress administrators to log out of admin sessions before browsing untrusted content and to use a dedicated browser profile for site administration.
Patch Information
The vendor addressed the issue in GiveWP 4.15.4 through WordPress Changeset 3573301, which adds nonce validation to give_set_notification_status_handler(). Full diff between the vulnerable and fixed versions is available in the WordPress Version Change 4.15.3 to 4.15.4 comparison.
Workarounds
- Restrict access to /wp-admin/admin-ajax.php at the web application firewall level, blocking cross-origin requests carrying the give_set_notification_status action.
- Deploy a WAF rule that requires a valid same-origin Referer or Origin header for POST requests to GiveWP admin endpoints.
- Temporarily deactivate the GiveWP plugin on sites that cannot be updated immediately, if operationally acceptable.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
