PHP Object Injection Vulnerability in GiveWP Donation Plugin for WordPress

CVE-2024-12877

Summary

The GiveWP Donation Plugin for WordPress is susceptible to PHP Object Injection due to improper handling of untrusted input from the donation form, such as the 'firstName' field. This vulnerability affects all versions up to and including 3.19.2 and allows unauthenticated attackers to inject malicious PHP objects. The presence of a Property-Oriented Programming (POP) chain could enable these attackers to execute remote code and potentially delete arbitrary files on the server. While version 3.19.3 attempted a patch, it was not fully effective, and a comprehensive solution was only provided in version 3.19.4. It is strongly recommended that the vendor implement JSON encoding to mitigate the risk of deserialization vulnerabilities in the future.

References