EUVD-2026-67682
GHSA-f9qw-6682-4v7w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network-reachable deserialization yielding full RCE justifies AV:N/AC:L/PR:N/UI:N and C/I/A:H; I assess S:U since code executes within the same web-application security authority rather than crossing to another.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection.
This issue affects GiveWP: from n/a through 4.16.7.1.
AnalysisAI
Unauthenticated PHP object injection in the GiveWP WordPress donation plugin (all versions through 4.16.7.1) lets remote attackers reach a deserialization sink and chain it into remote code execution on the hosting server. The flaw is network-reachable with no authentication or user interaction and carries a maximum CVSS of 10.0; Patchstack's public write-up details the full object-injection-to-RCE chain, though no in-the-wild exploitation has been confirmed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target run a vulnerable GiveWP version (any build up to and including 4.16.7.1) with the plugin active and its donation/form processing endpoints reachable over the network - the default state for a functioning donation site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Every raw signal points to top-tier priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) means network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and the C:H/I:H/A:H impact with S:C yields the maximum 10.0 score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade GiveWP to the first release published after 4.16.7.1 - the provided data does not name an exact fixed version, so no vendor-released patch version is confirmed here; verify the fixed build directly on the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-16-7-1-remote-code-execution-rce-vulnerability) or the WordPress plugin changelog before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: disable the GiveWP plugin immediately and review web server logs and database audit logs for compromise indicators dating back to installation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
GiveWP WordPress plugin before 4.16.3 exposes sensitive donor privacy data through an unauthenticated REST API endpoint
Stored cross-site scripting in the GiveWP WordPress plugin before version 4.16.3 allows authenticated users holding the
The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.
The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exp
The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute i
The GiveWP - Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-S
The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS. Rated me
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Deserialization of Untrusted Data vulnerability in Liquid Web GiveWP allows Object Injection.14.1. Rated critical severi
A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Rated critical sever
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today