PT-2025-9590 · WordPress · Donations Widget

Dream Hard

·

Published

2025-03-04

·

Updated

2026-01-07

·

CVE-2025-0912

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Donations Widget plugin for WordPress versions up to, and including, 3.19.4
Description The issue arises from improper handling of user-supplied data within the donation form, particularly in the card address parameter. This flaw allows unauthenticated attackers to exploit the deserialization of untrusted input, leading to potential remote code execution and, consequently, full server compromise. Attackers can leverage Property-Oriented Programming (POP) chains to escalate their access, enabling harmful actions like arbitrary file deletion or backdoor setups through web shells. Over 100,000 WordPress websites are at risk, with more than 30% of affected sites remaining unpatched.
Recommendations For versions up to, and including, 3.19.4, upgrade to version 3.20.0 to secure the plugin. As a temporary workaround, consider disabling the donation form or restricting access to it until a patch is applied. Avoid using the card address parameter in the affected donation form until the issue is resolved. Restrict access to the vulnerable plugin to minimize the risk of exploitation.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-0912

Affected Products

Donations Widget