CVE-2024-37099 WordPress GiveWP plugin <= 3.14.1 - Unauthenticated PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Liquid Web GiveWP allows Object Injection.This issue affects GiveWP: from n/a through 3.14.1...

CVE-2024-37099 WordPress GiveWP plugin <= 3.14.1 - Unauthenticated PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Liquid Web GiveWP allows Object Injection.This issue affects GiveWP: from n/a through 3.14.1...

CVE-2024-37099

CVE-2024-37099 affects WordPress GiveWP plugin versions n/a through 3.14.1. The issue is an unauthenticated PHP Object Injection via deserialization of untrusted data in GiveWP, enabling potential remote code execution. Patch 3.14.2 fixes the vulnerability. Vendor: Liquid Web / StellarWP. Current...

$4,998 Bounty Awarded and 100,000 WordPress Sites Protected Against Unauthenticated Remote Code Execution Vulnerability Patched in GiveWP WordPress Plugin

📢 Did you know Wordfence runs a Bug Bounty Program for all WordPress plugin and themes at no cost to vendors? Through October 14th, researchers can earn up to $31,200, for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, an...

WordPress plugin GiveWP 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

PT-2024-37256 · WordPress · Givewp

Name of the Vulnerable Software and Affected Versions: GiveWP – Donation Plugin and Fundraising Platform versions up to, and including, 3.14.1 Description: The issue is related to unauthorized access and deletion of data due to a missing capability check on the handle request function. This allow...

PT-2024-27297 · Liquid Web · Givewp

Name of the Vulnerable Software and Affected Versions: GiveWP versions n/a through 3.14.1 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection in Liquid Web GiveWP. Recommendations: For versions n/a through 3.14.1, update to a version later than...

PT-2024-37254 · WordPress · Givewp

Name of the Vulnerable Software and Affected Versions: GiveWP – Donation Plugin and Fundraising Platform versions up to, and including, 3.13.0 Description: The issue is related to unauthorized access of data due to a missing capability check on the setup wizard function. This allows unauthenticat...

PT-2024-6172

Name of the Vulnerable Software and Affected Versions GiveWP versions 3.14.1 and earlier Description The GiveWP plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input from the give title parameter. This vulnerability allows unauthenticated attackers to...

WordPress GiveWP plugin <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution (RCE) vulnerability

Unauthenticated PHP Object Injection to Remote Code Execution RCE vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin GiveWP versions = 3.14.1...

VulnCheck KEV: CVE-2024-37099

Deserialization of Untrusted Data vulnerability in Liquid Web GiveWP allows Object Injection.This issue affects GiveWP: from n/a through 3.14.1...

WordPress GiveWP Plugin <= 3.14.1 is vulnerable to PHP Object Injection

Software GiveWP Type Plugin Vulnerable versions = 3.14.1 Fixed in 3.14.2 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-37099 Patch priority High CVSS severity High 10 Developer Liquid Web / StellarWP PSID 44652f09d965 Credits LVT-tholv2k Required privilege...

CVE-2024-5977

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.13.0 via the 'handleRequest' function due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2024-5977

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.13.0 via the 'handleRequest' function due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2024-5977 GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.13.0 via the 'handleRequest' function due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2024-5977

CVE-2024-5977 affects GiveWP – Donation Plugin and Fundraising Platform for WordPress. The vulnerability is an Insecure Direct Object Reference (IDOR) in the handleRequest path, with missing validation on a user-controlled key, enabling authenticated users with GiveWP Worker-level access and abov...

CVE-2024-5977 GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.13.0 via the 'handleRequest' function due to missing validation on a user controlled key. This makes it possible for authenticated...

WordPress GiveWP plugin <= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions vulnerability

Insecure Direct Object Reference to Authenticated GiveWP Worker+ Arbitrary Post Actions vulnerability discovered by Thanh Nam Tran in WordPress Plugin GiveWP versions = 3.13.0...

WordPress GiveWP Plugin <= 3.13.0 is vulnerable to Insecure Direct Object References (IDOR)

Software GiveWP Type Plugin Vulnerable versions = 3.13.0 Fixed in 3.14.0 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-5977 Patch priority Low CVSS severity Low 5.4 Developer Liquid Web / StellarWP PSID 3e3c50f20b4c Credits Thanh Nam Tra...

PT-2024-37288 · WordPress · Givewp

Name of the Vulnerable Software and Affected Versions: GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress versions up to, and including, 3.13.0 Description: The issue is related to Insecure Direct Object Reference, which occurs due to missing validation on a user-controlled ke...