CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserialization of untrusted input from the Donation Form through the 'card_address' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution.
Explanation of Vulnerability in Simple Terms
GiveWP versions up to 3.19.4 contain a deserialization vulnerability that allows unauthenticated attackers to run arbitrary code on affected sites. The plugin unsafely deserializes untrusted data without proper validation, enabling remote code execution over the network. All sites running GiveWP 3.19.4 or earlier require immediate patching.
What an attacker can do
Run arbitrary code on the site without authentication.
Potential impact on your site
Complete site compromise: attackers can steal data, modify content, install malware, or take the site offline.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
