CVE-2024-5977: GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.13.0 via the 'handleRequest' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with GiveWP Worker-level access and above, to delete and update arbitrary posts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/GiveWP – Donation Plugin and Fundraising Platformto a version that resolves this vulnerability.Fixed in 3.13.0
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5977?
CVE-2024-5977 is a high severity vulnerability due to its potential for unauthorized access via Insecure Direct Object Reference.
How do I fix CVE-2024-5977?
To fix CVE-2024-5977, update the GiveWP plugin to version 3.14.0 or later.
What versions of the GiveWP plugin are affected by CVE-2024-5977?
CVE-2024-5977 affects all versions of the GiveWP plugin up to and including version 3.13.0.
What causes CVE-2024-5977?
CVE-2024-5977 is caused by missing validation on a user-controlled key in the 'handleRequest' function.
Who is at risk due to CVE-2024-5977?
Sites using the affected versions of the GiveWP plugin are at risk of unauthorized access and manipulation of donation data.