module
GiveWP Unauthenticated Donation Process Exploit
| Disclosed |
|---|
| Aug 25, 2024 |
Disclosed
Aug 25, 2024
Description
The GiveWP Donation Plugin and Fundraising Platform for WordPress, in all versions up to and including 3.16.1,
is vulnerable to a PHP Object Injection (POI) attack that allows unauthenticated arbitrary code execution.
Although a patch was introduced in version 3.14.2, it was incorrect and can be bypassed.
This means the vulnerability remains exploitable in subsequent versions due to the ineffective patch.
is vulnerable to a PHP Object Injection (POI) attack that allows unauthenticated arbitrary code execution.
Although a patch was introduced in version 3.14.2, it was incorrect and can be bypassed.
This means the vulnerability remains exploitable in subsequent versions due to the ineffective patch.
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.