WordPress GiveWP Plugin <= 2.25.3 is vulnerable to PHP Object Injection
CVE-2023-32513

7.5HIGH

Key Information:

Vendor
WordPress
Status
GiveWP – Donation Plugin and Fundraising Platform
Vendor
CVE Published:
28 December 2023

Summary

A deserialization of untrusted data vulnerability exists in the GiveWP Donation Plugin. This security flaw can allow attackers to exploit weaknesses related to PHP object injection, potentially leading to unauthorized access or system manipulation. It affects all versions of the GiveWP Donation Plugin and Fundraising Platform prior to 2.25.3, necessitating immediate updates to safeguard against potential exploitation. Users are urged to review their current plugin status and apply necessary patches to mitigate risks.

Affected Version(s)

GiveWP – Donation Plugin and Fundraising Platform <= 2.25.3

References

https://patchstack.com/database/vulnerability/give/wordpr...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafie Muhammad (Patchstack)
.