EUVD-2026-84269
GHSA-wq6q-gx9m-7669
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AC:H because impact depends on a co-installed POP chain plus a non-default multi-recipient configuration; PR:N/UI:N as the injection is unauthenticated, with C/I/A:H reflecting worst-case POP-chain outcomes.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This vulnerability is only reachable when the "Allow Multiple Recipients" option is enabled for the donation form, as the single-recipient code path applies sanitize_textarea_field() which would neutralize the payload. Exploitation additionally requires the eCard "Custom Message" option to be disabled, which is the plugin default: when it is enabled the personalized message becomes a required field and GiveWP's give_clean() blanks serialized input during validation, causing the donation to be rejected before it is stored.
Articles & Coverage 1
AnalysisAI
Unauthenticated PHP object injection in the Give Tributes WordPress plugin, affecting all versions up to and including 2.3.1, allows an attacker to place a crafted serialized object into donation data that the plugin later deserializes. The flaw is not exploitable in isolation: Give Tributes ships no POP/gadget chain, so it only produces impact when a separate plugin or theme on the same site supplies one, and even then the attacker must reach a form where 'Allow Multiple Recipients' is enabled (the single-recipient path runs sanitize_textarea_field() and neutralizes the payload) while the eCard 'Custom Message' option is disabled, the plugin default. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a specific non-default and multi-part configuration plus an external dependency: (1) the donation form must have 'Allow Multiple Recipients' ENABLED (the single-recipient path calls sanitize_textarea_field() and blocks the payload); (2) the eCard 'Custom Message' option must be DISABLED - this is the plugin default, but when enabled the personalized message becomes required and GiveWP's give_clean() blanks serialized input, rejecting the donation before storage; and critically (3) a usable POP/gadget chain must be present in a DIFFERENT plugin or theme on the same site, because Give Tributes contains no POP chain of its own - without one the injection has no impact. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The nominal CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), which on its face reads as a critical unauthenticated RCE-class flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data, so remediation must initially rely on configuration and attack-surface reduction while the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/0cdd5562-8755-4ca3-9c16-a5b364f8408b) and the Liquid Web Give product page (https://www.liquidweb.com/software/give/) are monitored for a fixed release, which should be applied as soon as it ships. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every WordPress instance running Give Tributes 2.3.1 or earlier, confirm which sites have 'Allow Multiple Recipients' enabled on any donation form, and disable that option or take the affected form offline pending remediation; where the plugin cannot be disabled or upgraded because no fixed version is available, apply a virtual patch or WAF rule that blocks serialized object payloads in donation form submissions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today