EUVD-2026-67682
GHSA-f9qw-6682-4v7w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed GiveWP endpoint
-
DeliverySend crafted serialized PHP object
-
ExploitTrigger unserialize() object injection
-
ExecutionInvoke POP gadget chain
-
PersistExecute code as web-server user
-
ImpactCompromise site and donor data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target run a vulnerable GiveWP version (any build up to and including 4.16.7.1) with the plugin active and its donation/form processing endpoints reachable over the network - the default state for a functioning donation site. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration are needed; Patchstack explicitly characterizes it as unauthenticated. The practical limiting factor is that reliable RCE depends on a suitable POP gadget chain being present among loaded classes (WordPress core, GiveWP, or other active plugins); sites are only exploitable while an unpatched, network-exposed GiveWP instance is running. |
| Impact | Every raw signal points to top-tier priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) means network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and the C:H/I:H/A:H impact with S:C yields the maximum 10.0 score. The vulnerability class (deserialization to RCE) is highly automatable once a working gadget chain is published, and Patchstack - the original reporter - has released an article walking through the unauthenticated object-injection-to-RCE path, which materially lowers the effort for an attacker to reproduce it. No EPSS score or CISA KEV entry is present in the provided data, so there is currently no confirmation of active exploitation or an independent probability estimate; the absence of KEV should not be read as low risk given the trivial preconditions. On balance this is a genuine emergency for any exposed GiveWP install rather than a high-CVSS-but-low-real-risk item, and operators of vulnerable sites should treat patching as urgent regardless of organization size. |
| Exploit ScenarioDerived | A remote attacker with no account sends a single crafted HTTP request to a public GiveWP donation endpoint, embedding a serialized PHP object payload. The plugin deserializes the input, triggering a POP gadget chain that executes attacker-supplied code as the web-server user, giving full control of the WordPress site and its donor database. Patchstack has published a technical write-up describing this exact object-injection-to-RCE chain, reducing the effort needed to weaponize it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 28, 2026
Unauthenticated PHP object injection in the GiveWP WordPress donation plugin (all versions through 4.16.7.1) lets remote attackers reach a deserialization sink and chain it into remote code execution on the hosting server. The flaw is network-reachable with no authentication or user interaction and carries a maximum CVSS of 10.0; Patchstack's public write-up details the full object-injection-to-RCE chain, though no in-the-wild exploitation has been confirmed. Because GiveWP handles donation and payment workflows, a successful attack fully compromises the site and any donor data it processes.
RemediationAI
Upgrade GiveWP to the first release published after 4.16.7.1 - the provided data does not name an exact fixed version, so no vendor-released patch version is confirmed here; verify the fixed build directly on the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-16-7-1-remote-code-execution-rce-vulnerability) or the WordPress plugin changelog before deploying. Until a patched version is applied, compensating controls include placing the site behind a WAF with rules that block PHP serialized-object payloads (patterns like 'O:' and 'a:' in request parameters), restricting or disabling the specific GiveWP donation/form endpoints that accept the untrusted input if the donation feature can be temporarily suspended (trade-off: donations stop working), and enabling Patchstack or an equivalent virtual-patching layer that ships a mitigation rule for this CVE. Given the unauthenticated network vector, also review logs for anomalous POST requests to GiveWP endpoints and rotate any secrets the web server could expose if compromise is suspected.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GiveWP is a widely used WordPress plugin for accepting online donations. The root cause is CWE-502 (Deserialization of Untrusted Data): attacker-controlled input reaches a PHP unserialize() call, allowing PHP Object Injection. When crafted serialized data instantiates objects whose magic methods (__wakeup, __destruct, __toString) are chained through classes available in WordPress core, GiveWP, or other loaded plugins (a POP gadget chain), the result escalates from object instantiation to arbitrary code execution. The affected CPE is cpe:2.3:a:liquid_web_/_stellarwp:givewp:*, covering the plugin published by StellarWP/Liquid Web across all builds up to and including 4.16.7.1.
Know when Givewp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network-reachable deserialization yielding full RCE justifies AV:N/AC:L/PR:N/UI:N and C/I/A:H; I assess S:U since code executes within the same web-application security authority rather than crossing to another.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection.
This issue affects GiveWP: from n/a through 4.16.7.1.
Latest POC
1 public PoC link from nuclei
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
GiveWP WordPress plugin versions 4.16.7.1 and below contain a critical unauthenticated code execution vulnerability allowing attackers to fully compromise donation infrastructure and access donor payment records without credentials. Organizations using GiveWP for fundraising or membership donations face immediate risk of data exfiltration, payment fraud, and service disruption. Remote attackers can trigger the flaw from the internet against exposed WordPress instances without user interaction.
No vendor-released patch identified for this vulnerability at time of analysis. Interim mitigations: immediately disable the GiveWP plugin; implement Web Application Firewall rules blocking requests to /wp-content/plugins/givewp/ paths; restrict WordPress admin access to trusted IP ranges only; disable XML-RPC and REST API if not required; segment payment infrastructure so donation systems cannot reach sensitive payment processors or donor databases; enable enhanced logging on PHP deserialization operations. If the plugin cannot be disabled, take the WordPress site offline until vendor patch or replacement solution is deployed.
Threat Model
5 threats: Elevation of Privilege, Denial of Service, Tampering and 2 more
4-step attack chain with trust boundaries and controls
Full threat model - attack chain, trust boundaries, controls per stage and evidence - is part of the Pro and Business plans.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Improper privilege management in the GiveWP WordPress donation plugin (affected ranging from 4.16.6 up to but not includ
GiveWP WordPress plugin before 4.16.3 exposes sensitive donor privacy data through an unauthenticated REST API endpoint
Stored cross-site scripting in the GiveWP WordPress plugin before version 4.16.3 allows authenticated users holding the
The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.
The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exp
The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute i
The GiveWP - Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-S
The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS. Rated me
Deserialization of Untrusted Data vulnerability in GiveWP GiveWP allows Object Injection.19.3. Rated critical severity (
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Exploit-DB