CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.
Explanation of Vulnerability in Simple Terms
GiveWP versions up to 3.14.1 contain a deserialization vulnerability that allows unauthenticated attackers to run arbitrary code on the site. The plugin unsafely deserializes untrusted data without proper validation, enabling remote code execution. All sites running affected versions should update immediately.
What an attacker can do
Run arbitrary code on the site and take complete control without needing a user account.
Potential impact on your site
Complete site compromise: attackers can steal data, modify content, install malware, or take the site offline.
Conditions required to exploit
None. The attacker needs only network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
