CVE-2023-32513 HIGH

CVE-2023-32513: WordPress GiveWP Plugin <= 2.25.3 is vulnerable to PHP Object Injection

Vendor Givewp
Product GiveWP – Donation Plugin and Fundraising Platform
Weakness CWE-502 · Unsafe deserialization
Published December 28, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Deserialization of Untrusted Data vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.3.

Explanation of Vulnerability in Simple Terms

02Summary

GiveWP versions up to 2.25.3 contain a deserialization vulnerability that allows attackers to execute arbitrary code on the site. An attacker can craft a malicious serialized object that, when processed by the plugin, runs their own PHP code with full site privileges. The attack requires user interaction—typically a victim clicking a malicious link or visiting an attacker-controlled page.

What an attacker can do

03Attacker Capabilities

Run their own PHP code on the site with full administrative privileges.

Potential impact on your site

04Site Impact

Complete compromise of the site, including access to all donation data, user accounts, and the ability to modify or delete content.

Conditions required to exploit

05Prerequisites

No authentication required, but the victim must click a link or visit a page controlled by the attacker.

Key dates

06Disclosure timeline

December 28, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-27060 WordPress ARMember Premium plugin <= 7.0 - PHP Object Injection vulnerability CVE-2026-39551 WordPress Töbel theme <= 1.8.1 - PHP Object Injection vulnerability CVE-2026-59544 WordPress Thrive Quiz Builder plugin <= 10.9.3.0 - PHP Object Injection vulnerability CVE-2026-12240 Export User Data <= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion via display_name Field CVE-2026-9691 WordPress Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.1 - PHP Object Injection vulnerability