Udin Chan

**Name of the Vulnerable Software and Affected Versions** GiveWP versions prior to 4.16.7.2 **Description** An issue involving the deserialization of untrusted data allows for PHP object injection, which can be chained from an unauthenticated starting point to achieve remote code execution. The attack leverages the GiveWP registration endpoint to create an account and store a malicious serialized object. When a crafted donation is submitted and the session reloads the payload, a PHP gadget chain is triggered, eventually reaching the `system()` function to execute arbitrary operating-system commands as the web-server user. This process can also bypass the WordPress `users can register` setting. More than 100,000 sites are potentially affected. **Recommendations** Update GiveWP to version 4.16.7.2 or later.