CVE-2024-5932

Name of the Vulnerable Software and Affected Versions GiveWP versions prior to 3.14.2

Description The GiveWP – Donation Plugin and Fundraising Platform for WordPress is affected by a PHP Object Injection flaw. This issue occurs due to the deserialization of untrusted input provided via the give title parameter within the give process donation form() function. Unauthenticated attackers can exploit this to inject a PHP Object and utilize a POP (Property Oriented Programming) chain—a technique used to execute a sequence of existing code snippets (gadgets) within an application—to achieve remote code execution or delete arbitrary files on the server. In some cases, deleting specific files may allow an attacker to reset site settings and potentially take full control of the website. Over 100,000 WordPress sites are estimated to be affected worldwide.

Recommendations Update the plugin to version 3.14.2 or higher. As a temporary workaround, restrict or avoid using the give title parameter in donation forms until the update is applied.