PHP Object Injection Vulnerability in Give Tributes Plugin for WordPress
CVE-2026-19658

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Give Tributes
Vendor
CVE Published:
22 September 2026

What is CVE-2026-19658?

The Give Tributes plugin for WordPress is susceptible to PHP Object Injection due to improper handling of untrusted input through deserialization, affecting all versions up to 2.3.1. This vulnerability allows unauthenticated attackers to inject PHP objects. Notably, the vulnerability is only exploitable when the 'Allow Multiple Recipients' option is enabled in the donation form, and when the eCard 'Custom Message' option is disabled. If both conditions are met and a vulnerable plugin or theme is installed that contains a PHP Object Payload (POP) chain, attackers could potentially delete files, extract sensitive information, or execute malicious code. Thus, securing your WordPress installation and keeping plugins updated is essential to mitigate these risks.

Affected Version(s)

Give Tributes 0 <= 2.3.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://www.liquidweb.com/software/give/

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Voyag3r-Security
.