CVE-2024-5932: GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'givetitle' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5932?
CVE-2024-5932 has critical severity due to its potential for PHP Object Injection, allowing unauthenticated attackers to exploit it.
How do I fix CVE-2024-5932?
To fix CVE-2024-5932, update the GiveWP plugin to version 3.14.2 or later.
What versions of the GiveWP plugin are affected by CVE-2024-5932?
All versions of the GiveWP plugin up to and including 3.14.1 are affected by CVE-2024-5932.
Can unauthenticated users exploit CVE-2024-5932?
Yes, unauthenticated attackers can exploit CVE-2024-5932 due to PHP Object Injection vulnerabilities.
What is the impact of CVE-2024-5932 on WordPress sites?
The impact of CVE-2024-5932 on WordPress sites includes potential arbitrary code execution, leading to full site compromise.