Give Tributes
Monthly
Unauthenticated PHP object injection in the Give Tributes WordPress plugin, affecting all versions up to and including 2.3.1, allows an attacker to place a crafted serialized object into donation data that the plugin later deserializes. The flaw is not exploitable in isolation: Give Tributes ships no POP/gadget chain, so it only produces impact when a separate plugin or theme on the same site supplies one, and even then the attacker must reach a form where 'Allow Multiple Recipients' is enabled (the single-recipient path runs sanitize_textarea_field() and neutralizes the payload) while the eCard 'Custom Message' option is disabled, the plugin default. Our independent assessment keeps this at PR:N/UI:N but raises attack complexity to High for the required non-default configuration plus third-party gadget dependency, rather than the nominal CVSS 9.8/AC:L rating; no public exploit code has been identified at time of analysis.
Unauthenticated PHP object injection in the Give Tributes WordPress plugin, affecting all versions up to and including 2.3.1, allows an attacker to place a crafted serialized object into donation data that the plugin later deserializes. The flaw is not exploitable in isolation: Give Tributes ships no POP/gadget chain, so it only produces impact when a separate plugin or theme on the same site supplies one, and even then the attacker must reach a form where 'Allow Multiple Recipients' is enabled (the single-recipient path runs sanitize_textarea_field() and neutralizes the payload) while the eCard 'Custom Message' option is disabled, the plugin default. Our independent assessment keeps this at PR:N/UI:N but raises attack complexity to High for the required non-default configuration plus third-party gadget dependency, rather than the nominal CVSS 9.8/AC:L rating; no public exploit code has been identified at time of analysis.