PT-2025-1320 · Givewp · Givewp

Edisc + 1 · Published 2025-01-07 · Updated 2025-06-04 · CVE-2025-22777

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

The software that is vulnerable is the GiveWP WordPress Plugin, specifically versions from n/a through 3.19.3. The vulnerability is a Deserialization of Untrusted Data vulnerability, also known as an Unauthenticated PHP Object Injection, which allows attackers to take control of websites. This vulnerability has a critical rating and affects 100,000 active installations of the plugin. The vulnerability can be exploited by attackers to gain control of websites via donation forms, allowing full site takeover (RCE), and it is recommended to patch the vulnerability as soon as possible by updating to version 3.19.4. There is a public exploit available, and over 11,000 results are found on ZoomEye, indicating potential exploitation by attackers. The vulnerability is identified as CVE-2025-22777. #GiveWP #WordPressPlugin #PrivilegeEscalation #PHPObjectInjection #CVE202522777 #WordPressVulnerability #GiveWPPatch #WordPressSecurity #Cybersecurity

Fix

LPE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-01026

CVE-2025-22777

Affected Products

Givewp

References · 23

• https://bdu.fstec.ru/vul/2025-01026 · Security Note
• https://osv.dev/vulnerability/CVE-2025-22777 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-22777 · Security Note
• https://t.me/netlas/315 · Telegram Post
• https://twitter.com/dailycve/status/1930297967614812399 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1878852570946429379 · Twitter Post
• https://securityonline.info/cve-2025-22777-cvss-9-8-critical-security-alert-for-givewp-plugin-with-100000-active-installations · Note
• https://twitter.com/fridaysecurity/status/1878250896175345779 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1878252183243886772 · Twitter Post
• https://t.me/brutsecurity/1282 · Telegram Post
• https://twitter.com/TweetThreatNews/status/1878802774151819266 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-3-19-3-php-object-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/CveFindCom/status/1878797158570233912 · Twitter Post
• https://t.me/cvedetector/15136 · Telegram Post
• https://twitter.com/Dinosn/status/1878292346292335059 · Twitter Post