GiveWP has patched an unauthenticated PHP object injection vulnerability that can be chained to achieve remote code execution, with a CVSS rating of 10 — the highest possible rating. The plugin, used by nonprofits and other organizations for online fundraising, has 100,000+ active installations.
Patchstack disclosed the vulnerability in a security advisory today, crediting researcher Udin Chan with the discovery. Chan reported the vulnerability on July 28. GiveWP shipped a fix in version 4.16.7.2 on Thursday, after Patchstack rejected several earlier patch attempts during the month-long disclosure process.
According to Patchstack, an attacker doesn’t need an existing account to carry out the attack. GiveWP exposes an unauthenticated registration action that doesn’t respect WordPress’s own user-registration setting, letting anyone create an account even when public registration is disabled.
A flaw in the plugin’s safeUnserialize() helper lets attacker-controlled serialized data pass through processing and get stored in the site’s database. GiveWP also ships a gadget chain that can be used to execute arbitrary operating-system commands. On GiveWP 4.16.5.1 and earlier, a default installation with a published donation form and an active payment gateway is enough to exploit. Versions 4.16.6 through 4.16.7.1 narrowed the attack path, but the underlying vulnerability remained.
Version 4.16.7.2 breaks the chain at multiple independent points, including the handling of serialized data and the code used in the gadget chain. The update also ships a database migration that scrubs potentially malicious serialized objects that may already be stored in the database.
The unauthenticated registration issue remains in 4.16.7.2, though Patchstack says it can no longer be used as part of the RCE chain once the object injection is closed.
This isn’t the first time GiveWP has been affected by PHP object injection. Patchstack’s vulnerability database for GiveWP lists multiple PHP object injection flaws affecting the plugin since 2024, including several unauthenticated vulnerabilities that could lead to remote code execution.
Neither GiveWP nor parent company Liquid Web had commented publicly on the disclosure as of publication.
GiveWP users should update to version 4.16.7.2 as soon as possible.
Disclosure: Patchstack is a sponsor of The Repository.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
