CVE-2024-9634: GiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.3 via deserialization of untrusted input from the givecompanyname parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9634?
CVE-2024-9634 has a critical severity level due to its potential for remote code execution via PHP Object Injection.
How do I fix CVE-2024-9634?
To fix CVE-2024-9634, upgrade the GiveWP Donation Plugin to version 3.16.4 or later.
What software is affected by CVE-2024-9634?
CVE-2024-9634 affects the GiveWP Donation Plugin versions up to and including 3.16.3.
Is authentication required to exploit CVE-2024-9634?
No, CVE-2024-9634 can be exploited by unauthenticated users.
What type of vulnerability is CVE-2024-9634?
CVE-2024-9634 is a PHP Object Injection vulnerability caused by the deserialization of untrusted input.