Critical severity · published Sep 28, 2024
CVE-2024-8353
GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection
9.8
CVSS
32.4%
EPSS
No
On KEV
Description
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like 'give_title' and 'card_address'. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files and achieve remote code execution. This is essentially the same vulnerability as CVE-2024-5932, however, it was discovered the the presence of stripslashes_deep on user_info allows the is_serialized check to be bypassed. This issue was mostly patched in 3.16.1, but further hardening was added in 3.16.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)32.4% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GD
GiveWP – Donation Plugin and Fundraising Platform · stellarwp
through 3.16.1 · source: vendor
GI
Givewp · Givewp
before 3.16.2 · source: NVD
DP
Donation Plugin And Fundraising Platform · Givew
through 3.16.1 · source: CISA
Affected product
GD
GiveWP – Donation Plugin and Fundraising Platform
stellarwp
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-8353
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-8353
Product
https://plugins.trac.wordpress.org/browser/give/tags/3.16.0/includes/process-donation.php#L154
Patch
https://plugins.trac.wordpress.org/changeset/3149290/give/tags/3.16.1/includes/admin/admin-actions.php
Patch
https://plugins.trac.wordpress.org/changeset/3149290/give/tags/3.16.1/includes/process-donation.php
Patch
https://plugins.trac.wordpress.org/changeset/3149290/give/tags/3.16.1/src/Helpers/Utils.php
Patch
https://plugins.trac.wordpress.org/changeset/3157829/give/tags/3.16.2/includes/process-donation.php
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/c4c530fa-eaf4-4721-bfb6-9fc06d7f343c?source=cve
More from GiveWP – Donation Plugin and Fundraising Platform
9.8
CVE-2025-0912
GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injection
9.8
CVE-2024-12877
GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection
9.8
CVE-2024-9634
GiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution
9.8
CVE-2024-5932
GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution
7.5
CVE-2025-2025
Give <= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function