CVE-2024-8353

🗓️ 28 Sep 2024 02:04:28Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 144 Views🌐 WEB

The GiveWP WordPress plugin is vulnerable to PHP Object Injection and remote code execution via untrusted input deserialization in versions up to 3.16.

Reporter	Title	Published	Views	Family All 18
GithubExploit	Exploit for Deserialization of Untrusted Data in Givewp	30 Sep 202417:33	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Givewp	21 Aug 202409:51	–	githubexploit
Circl	CVE-2024-8353	28 Aug 202420:39	–	circl
CNNVD	WordPress plugin GiveWP 代码问题漏洞	28 Sep 202400:00	–	cnnvd
Cvelist	CVE-2024-8353 GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection	28 Sep 202402:04	–	cvelist
Metasploit	GiveWP Unauthenticated Donation Process Exploit	25 Aug 202400:00	–	metasploit
Nuclei	GiveWP Donation Plugin <= 3.16.1 - Unauthenticated PHP Object Injection	16 Aug 202602:26	–	nuclei
NVD	CVE-2024-8353	28 Sep 202402:15	–	nvd
OpenVAS	WordPress GiveWP Plugin < 3.16.2 Multiple vulnerabilities	16 Oct 202400:00	–	openvas
OSV	CVE-2024-8353	28 Sep 202402:15	–	osv

NVD

Vulners

Vulnrichment

Node

givewp givewpRange<3.16.2wordpress

[
  {
    "vendor": "stellarwp",
    "product": "GiveWP – Donation Plugin and Fundraising Platform",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.16.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/give/tags/3.16.0/includes/process-donation.php
plugins	www.plugins.trac.wordpress.org/changeset/3157829/give/tags/3.16.2/includes/process-donation.php
plugins	www.plugins.trac.wordpress.org/changeset/3149290/give/tags/3.16.1/src/Helpers/Utils.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/c4c530fa-eaf4-4721-bfb6-9fc06d7f343c
plugins	www.plugins.trac.wordpress.org/changeset/3149290/give/tags/3.16.1/includes/process-donation.php
plugins	www.plugins.trac.wordpress.org/changeset/3149290/give/tags/3.16.1/includes/admin/admin-actions.php

Parameter	Position	Path	Description	CWE
give_title	request body	/wp-admin/admin-ajax.php	PHP Object Injection in GiveWP via deserialization of untrusted input in donation processing flow, enabling unauthenticated RCE.	CWE-502
card_address	request body	/wp-admin/admin-ajax.php	PHP Object Injection in GiveWP via deserialization of untrusted input in donation processing flow, enabling unauthenticated RCE.	CWE-502

17 Jun 2026 08:22Current

9.8High risk

Vulners AI Score9.8

CVSS 3.19.8 - 10

EPSS0.2872

SSVC

CWE-502