CVE-2024-5932

What it actually does

CVE-2024-5932 is an unauthenticated PHP object injection vulnerability in the GiveWP WordPress plugin affecting versions up to and including 3.14.1. The plugin deserializes attacker-controlled input supplied through the give_title parameter. Because exploitable gadget chains are available in the plugin/runtime context, a remote attacker can cause unsafe object creation that may lead to arbitrary PHP code execution and arbitrary file deletion. The CVSS 10.0 score reflects network reachability, no authentication requirement, no user interaction, and full confidentiality, integrity, and availability impact. Public weaponized exploitation is available and EPSS is high, indicating meaningful likelihood of exploitation in exposed WordPress sites.

Why it matters to the business

A vulnerable public WordPress donation site can be fully compromised without valid credentials. Successful exploitation may allow attackers to take over the website, steal donor or payment-adjacent data processed by the site, modify donation pages, install malware or web shells, redirect donors to fraudulent pages, destroy files, or use the server for broader attacks. For organizations that rely on GiveWP for fundraising, the operational impact can include donation disruption, reputational damage, incident response costs, regulatory exposure, and loss of donor trust. Because exploitation is weaponized and the vulnerability is easy to reach over the internet, externally exposed sites should be treated as urgent even though the issue is not currently listed in CISA KEV.

How an attack unfolds

An attacker identifies a WordPress site running a vulnerable version of the GiveWP plugin. They send an unauthenticated HTTP request to the plugin’s donation-processing functionality with a crafted give_title value containing a serialized PHP object payload. When the plugin processes the request, it deserializes that untrusted value. In vulnerable deployments, available PHP object gadget chains can be abused during object construction, destruction, or magic method execution. Depending on the payload and available chain, the attacker can execute PHP code in the context of the web server process or delete files accessible to that process. After gaining code execution, attackers commonly deploy a web shell, create or modify WordPress administrator accounts, alter plugin or theme files, stage additional malware, collect configuration secrets such as database credentials, and establish persistence.

How to fix it

Upgrade the GiveWP plugin immediately to a patched release. Versions up to and including 3.14.1 are vulnerable; upgrade to GiveWP 3.14.2 or later, preferably the latest available version from the official WordPress plugin repository or vendor release channel. If immediate upgrade is not possible, disable or remove the GiveWP plugin until it can be patched. Restrict public access to donation-processing endpoints only as a temporary mitigation, because the vulnerable path is intended to be internet-facing. Review the site for compromise before returning it to service, especially if it was internet-exposed while running a vulnerable version. Rotate WordPress administrator passwords, application secrets, database credentials, API keys, and payment/donation service credentials if compromise is suspected. Ensure file permissions prevent the web server user from writing to unnecessary directories, and consider deploying a WordPress-aware WAF rule that blocks serialized PHP objects in donation parameters, especially give_title.

How to confirm the fix worked

Confirm the installed GiveWP version is greater than 3.14.1 through the WordPress admin plugin page, wp-cli, or the plugin metadata file. For wp-cli, use `wp plugin list` and verify the GiveWP plugin reports a patched version. Inspect `wp-content/plugins/give/readme.txt` or the main plugin file only as a secondary check, because file-based version indicators can be stale or modified after compromise. Confirm the vulnerable plugin is not present in backups, staging sites, container images, golden images, or cloned WordPress deployments exposed to the internet. Validate that unauthenticated requests containing serialized-object patterns in the give_title parameter are blocked or rejected after patching. Review web server, WAF, PHP, and WordPress logs for historical requests to GiveWP donation endpoints containing serialized PHP object markers before considering the issue fully remediated.

Typical attack path

1. Scan the internet for WordPress sites exposing GiveWP donation functionality.
2. Fingerprint the GiveWP plugin version or infer exposure from vulnerable donation endpoints and static plugin assets.
3. Send an unauthenticated crafted donation-processing request containing a serialized object payload in the give_title parameter.
4. Trigger unsafe PHP deserialization inside the vulnerable GiveWP code path.
5. Use an available POP/gadget chain to execute PHP code or delete files.
6. Deploy a web shell or modify WordPress plugin/theme files for persistence.
7. Access WordPress configuration, database credentials, donor-related data, or administrator sessions.
8. Use the compromised site for credential theft, payment redirection, spam, malware hosting, or further lateral activity.

How to detect it

Investigate web server access logs, reverse proxy logs, CDN/WAF logs, PHP error logs, WordPress debug logs, file integrity monitoring, endpoint telemetry, and hosting control panel audit logs. Focus on unauthenticated POST requests to GiveWP donation-processing endpoints, especially WordPress AJAX requests or donation form submissions containing a give_title parameter with serialized PHP object syntax. Look for URL-encoded serialization markers such as `O%3A`, `s%3A`, `a%3A`, or raw values like `O:` in the give_title field. Review responses around suspicious requests for HTTP 200, 302, or 500 status codes, followed by newly created or modified PHP files. Inspect common persistence locations such as `wp-content/uploads/`, `wp-content/plugins/`, `wp-content/themes/`, `wp-content/mu-plugins/`, and the WordPress document root. Check for unexpected administrator user creation, plugin/theme editor activity, new scheduled tasks or cron entries, outbound connections from the web server process, and abnormal PHP child processes invoking shell utilities. If arbitrary file deletion occurred, look for missing plugin files, missing WordPress core files, failed include/require errors, and sudden application breakage shortly after suspicious GiveWP requests.

• give_title=O%3A
• give_title=O:
• give_title%5D=O%3A
• give_title%5D=O:
• action=give_process_donation
• give_process_donation
• /wp-admin/admin-ajax.php
• /wp-content/plugins/give/
• /wp-content/uploads/*.php
• /wp-content/mu-plugins/*.php
• /wp-content/themes/*.php
• /wp-content/plugins/*.php
• PHP Fatal error: Uncaught Error: Class
• PHP Warning: unlink(
• PHP Warning: file_put_contents(
• PHP Warning: include(
• PHP Warning: require(
• O%3A%22
• O:8:%22
• O:9:%22
• O:10:%22

What your security team should do

• Patch or disable GiveWP on all internet-exposed WordPress sites immediately; prioritize any site running GiveWP 3.14.1 or earlier.
• Perform compromise assessment on any site that was exposed while vulnerable, because exploitation is unauthenticated and weaponized.
• Search web server, WAF, CDN, and WordPress logs for suspicious give_title parameters containing PHP serialization markers such as `O:` or URL-encoded equivalents.
• Inspect WordPress file integrity, especially plugin, theme, uploads, mu-plugins, and root web directories, for recently modified PHP files or web shells.
• Review WordPress users for unauthorized administrator accounts, unexpected password resets, new API/application passwords, and suspicious login activity.
• Rotate credentials and secrets if exploitation is suspected, including WordPress admin passwords, database credentials, salts, API keys, donation/payment integration secrets, and hosting control panel credentials.
• Add WAF detections for serialized PHP object payloads in POST bodies and query strings targeting GiveWP donation-processing endpoints.
• Harden WordPress file permissions to limit web server write access and disable direct PHP execution in uploads directories where feasible.
• Ensure centralized logging retains full request URI and POST-body metadata where legally and operationally appropriate for future investigation.