CVE-2024-5932

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.

• CWE-502
• CWE-502

• https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/includes/login-register.php#L235Patch
• https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/includes/process-donation.php#L420Patch
• https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/src/DonorDashboards/Tabs/EditProfileTab/AvatarRoute.php#L51Patch
• https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/vendor/tecnickcom/tcpdf/tcpdf.php#L7861Patch
• https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/vendor/vendor-prefixed/fakerphp/faker/src/Faker/ValidGenerator.php#L80Patch
• https://plugins.trac.wordpress.org/changeset/3132247/Patch
• https://www.wordfence.com/blog/2024/08/4998-bounty-awarded-and-100000-wordpress-sites-protected-against-unauthenticated-remote-code-execution-vulnerability-patched-in-givewp-wordpress-plugin/Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/93e2d007-8157-42c5-92ad-704dc80749a3?source=cveThird Party Advisory

Published

Aug 20, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-5926A path traversal vulnerability in the get-project-files func…9.1
• CVE-2024-5927Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-5928VIPRE Advanced Security PMAgent Link Following Local Privile…7.8
• CVE-2024-5929VIPRE Advanced Security PMAgent Uncontrolled Search Path Ele…7.8
• CVE-2024-5930VIPRE Advanced Security Incorrect Permission Assignment Loca…7.8
• CVE-2024-5931BT: Unchecked user input in bap_broadcast_assistant6.5
• CVE-2024-5933A Cross-site Scripting (XSS) vulnerability exists in the cha…5.4
• CVE-2024-5934Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-5935A Cross-Site Request Forgery (CSRF) vulnerability in version…5.4
• CVE-2024-5936An open redirect vulnerability exists in imartinez/privategp…6.1
• CVE-2024-5937The Simple Alert Boxes plugin for WordPress is vulnerable to…6.4
• CVE-2024-5938The Boot Store theme for WordPress is vulnerable to Stored C…5.4