Untrusted Input Vulnerability in GiveWP Donation Plugin Allows PHP Object Injection and Remote Code Execution

CVE-2024-9634

Summary

The GiveWP Donation Plugin for WordPress is impacted by a significant security issue involving PHP Object Injection. This vulnerability arises from the deserialization of untrusted input, specifically through the give_company_name parameter. Attackers exploiting this vulnerability can inject a PHP Object into the application, with the potential for a crafted payload to execute remote code. This poses a severe threat to the integrity and confidentiality of the affected WordPress installations. Users are advised to review their plugin versions and apply necessary updates to mitigate this risk.

References