Login Request a demo
Critical severity · published Aug 20, 2024
CVE-2024-5932
GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution
9.8
CVSS
76.8%
EPSS
No
On KEV
Description
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)76.8% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GD
GiveWP – Donation Plugin and Fundraising Platform · stellarwp
through 3.14.1 · source: vendor
GI
Givewp · Givewp
before 3.14.2 · source: NVD, CISA
Affected product
GD
GiveWP – Donation Plugin and Fundraising Platform
stellarwp
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-5932
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-5932
Patch
https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/includes/login-register.php#L235
Patch
https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/includes/process-donation.php#L420
Patch
https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/src/DonorDashboards/Tabs/EditProfileTab/AvatarRoute.php#L51
Patch
https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/vendor/tecnickcom/tcpdf/tcpdf.php#L7861
Patch
https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/vendor/vendor-prefixed/fakerphp/faker/src/Faker/ValidGenerator.php#L80
Patch
https://plugins.trac.wordpress.org/changeset/3132247/
More from GiveWP – Donation Plugin and Fundraising Platform
9.8
CVE-2025-0912
GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injection
9.8
CVE-2024-12877
GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection
9.8
CVE-2024-9634
GiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution
9.8
CVE-2024-8353
GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection
7.5
CVE-2025-2025
Give <= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function