PT-2024-38967 · WordPress · Givewp

Cuokon · Published 2024-09-28 · Updated 2025-09-08 · CVE-2024-8353

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GiveWP – Donation Plugin and Fundraising Platform versions 3.16.1 and earlier

Description The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input through several parameters like give title and card address. This allows unauthenticated attackers to inject a PHP Object, and the presence of a POP chain enables them to delete arbitrary files and achieve remote code execution. Over 100,000 WordPress sites are estimated to be at risk.

Recommendations For versions 3.16.1 and earlier, update to version 3.16.2 or later to fully resolve the issue. As a temporary workaround, consider disabling the vulnerable parameters give title and card address until a patch is available. Restrict access to the plugin's functionality to minimize the risk of exploitation.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-8353

Affected Products

Givewp

References · 36

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_givewp_rce.rb · Exploit
• 🔥 https://github.com/EQSTLab/CVE-2024-8353 · Exploit
• https://plugins.trac.wordpress.org/changeset/3149290/give/tags/3.16.1/includes/admin/admin-actions.php · Patch
• https://plugins.trac.wordpress.org/changeset/3157829/give/tags/3.16.2/includes/process-donation.php · Patch
• https://plugins.trac.wordpress.org/changeset/3149290/give/tags/3.16.1/includes/process-donation.php · Patch
• https://plugins.trac.wordpress.org/changeset/3149290/give/tags/3.16.1/src/Helpers/Utils.php · Patch
• https://osv.dev/vulnerability/CVE-2024-8353 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8353 · Security Note
• https://twitter.com/pdnuclei/status/1964871372225581338 · Twitter Post
• https://twitter.com/EQSTLab/status/1840818152848179318 · Twitter Post
• https://twitter.com/EQSTLab/status/1848310206259753138 · Twitter Post
• https://twitter.com/fletch_ai/status/1841025322864820611 · Twitter Post
• https://twitter.com/Matrix_Weaver/status/1906707146177466728 · Twitter Post
• https://twitter.com/EQSTLab/status/1848310270181175701 · Twitter Post
• https://twitter.com/cracbot/status/1841357543760949556 · Twitter Post