A PHP object injection in a popular donation plugin let unauthenticated attackers run code and delete files. What site owners should do.
Publicly disclosed: 20 August 2024
GiveWP is a widely used WordPress plugin for online donations and fundraising. A flaw in how it processed one of the donation form fields allowed an unauthenticated attacker to inject a PHP object and, through code already present in the plugin, execute commands on the server or delete files.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2024-5932 | Critical, CVSS 9.8–10.0 (PHP object injection, remote code execution) | GiveWP up to 3.14.1 | 3.14.2 and later |
Forms that accept data from anonymous visitors — donations, orders, registrations — are the first place attackers look. Keep the plugins behind them especially up to date.
Sources: NVD CVE-2024-5932.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.
