GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution

Summary

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.

Timeline

1. Aug 20, 2024, 2:03 AM UTCCVE published
2. Aug 20, 2024, 1:40 PM UTCCISA SSVC assessment

   Exploitation: poc · Automatable: yes · Technical impact: total

3. Apr 8, 2026, 5:09 PM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• stellarwp GiveWP – Donation Plugin and Fundraising Platform

  through 3.14.1

References 15