What the vulnerability does
01Description
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like 'give_title' and 'card_address'. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files and achieve remote code execution. This is essentially the same vulnerability as CVE-2024-5932, however, it was discovered the the presence of stripslashes_deep on user_info allows the is_serialized check to be bypassed. This issue was mostly patched in 3.16.1, but further hardening was added in 3.16.2.
Explanation of Vulnerability in Simple Terms
02Summary
GiveWP versions up to 3.16.1 contain a deserialization vulnerability that allows unauthenticated attackers to run arbitrary code on affected sites. The plugin unsafely deserializes untrusted data without proper validation, enabling remote code execution over the network. No user interaction or special privileges are required to exploit this flaw.
What an attacker can do
03Attacker Capabilities
Run arbitrary code on the site, read sensitive data, modify content, or take full control of the WordPress installation.
Potential impact on your site
04Site Impact
Complete compromise of the WordPress site and any data it contains; attackers can steal donor information, payment details, and site credentials.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication, special privileges, or user interaction required.
Key dates
06Disclosure timeline
September 28, 2024
CVE published
April 8, 2026
Record updated
