A CVSS 10 vulnerability CVE-2024-8353 has been reported in the GiveWP donation plugin. The plugin is in use on over 100,000 WordPress sites. The vulnerability was reported first on 27 September 2024.
The fix for the vulnerability is available in version 3.16.2.
About CVE-2024-8353
The CVE-2024-8353 is a CVSS 10 CRITICAL vulnerability.
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like ‘give_title’ and ‘card_address’.
This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files and achieve remote code execution.
This is essentially the same vulnerability as CVE-2024-5932, however, it was discovered the the presence of stripslashes_deep on user_info allows the is_serialized check to be bypassed.
This issue was mostly patched in 3.16.1, but further hardening was added in 3.16.2.
Remediation for CVE-2024-8353
The CVSS 10 vulnerability in GiveWP Plugin has been fixed in the latest update released by the developers. GiveWP version 3.16.2 has a fix for the vulnerability.
All WordPress websites running the GiveWP plugin should upgrade the installation to the latest version release 3.16.2. It was released by the developers 4 days back. You can download the patch from the WordPress plugin page.
Current Cybersecurity Stories
Rajesh Dhawan is a technology professional who loves to write about Cyber-security events and stories, Cloud computing and Microsoft technologies. He loves to break complex problems into manageable chunks of meaningful information.