CVE-2024-8353

GiveWP, the WordPress donation and fundraising plugin, is vulnerable to unauthenticated PHP object injection (CWE-502) through deserialization of untrusted input in parameters such as 'give_title' and 'card_address'. A stripslashes_deep call applied to the user_info data bypasses the plugin's is_serialized check, allowing attacker-supplied serialized payloads to be accepted and instantiated as PHP objects during donation submissions. Because a usable POP chain is present in the plugin, attackers can delete arbitrary files and achieve remote code execution on the affected site. All GiveWP versions up to and including 3.16.1 are affected, and the flaw is essentially the same vulnerability as CVE-2024-5932. The issue was mostly patched in 3.16.1 with further hardening added in 3.16.2; it carries a critical CVSS 9.8 score, has no known public proof-of-concept, is not yet in CISA's KEV catalog, and shows a high 28.7% EPSS probability of exploitation within 30 days.

What to do: Upgrade GiveWP to version 3.16.2 or later, which contains the additional hardening beyond the partial 3.16.1 fix. Sites that cannot update immediately should review logs and the site for signs of exploitation such as unexplained file deletions or unexpected code changes, and consider a web application firewall rule that blocks serialized-looking input in donation form fields.