GiveWP WordPress donation plugin flaw lets hackers execute server commands
-
A maximum-severity flaw has been disclosed in GiveWP, a popular WordPress donation and fundraising plugin, which could allow unauthenticated attackers to execute arbitrary commands directly on the hosting server. The vulnerability stems from a PHP Object Injection issue within the plugin’s handling of user-supplied input, leading to remote code execution. Given the plugin’s widespread use by non-profits and fundraising sites, the risk of exploitation is considered critical.
The security issue affects GiveWP versions prior to 3.19.3. The flaw is triggered through a specific chain that , when combined with a separate gadget in the WordPress core, allows the attacker to achieve full server-side command execution without requiring any authentication. Because no login or special permissions are needed, any visitor to a vulnerable site could potentially compromise the entire server, including other hosted sites or data.
The vulnerability was discovered by security researcher villu164, who reported it through the WPScan initiative. The patch was quietly included in the stable release, and administrators are strongly advised to update immediately. Failure to do so could expose donation records, personal donor information, and server credentials. In addition to upgrading, site owners should audit their logs for suspicious activity and review file integrity for signs of backdoors.
- Affected: GiveWP versions prior to 3.19.3
- Action required: Update to version 3.19.3 or later
- Impact: Unauthenticated remote code execution via PHP Object Injection
Source: Unknown
Given how many donation and non-profit sites rely on GiveWP, has your organization already applied the latest update, and what steps are you taking to verify whether any suspicious server-side activity occurred before the patch was released?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login