CVE-2024-5932

GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution

CRITICAL 9.8EPSS 76.8%

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.

Affected: stellarwp · GiveWP – Donation Plugin and Fundraising Platform
CVSS v3.1 NVD: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v3.1 WORDFENCE: 10.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS: 76.80% chance of exploitation in the next 30 days, 100th percentile
Nuclei: critical · CWE-502
Published: 2024-08-20
Updated: 2026-04-08

Proof-of-concept exploits (9)

0xb0mb3r/CVE-2024-5932-PoC3★ · 2024-12-13
0xb0mb3r/CVE-2024-8353-PoC3★ · 2024-12-13
EQSTLab/CVE-2024-593277★ · 2025-01-12
EQSTLab/CVE-2024-835312★ · 2024-10-01
OxLmahdi/cve-2024-59321★ · 2024-10-11
hlc23/CVE-2024-5932-web-ui0★ · 2025-08-15
tk-1001/PHPexploit_pack0★ · 2025-06-04
autom4il/CVE-2024-59320★ · 2025-11-04
nishant-kumar-5173/CVE-2024-59320★ · 2026-05-21

Nuclei templates (1)

projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5932.yaml

Metasploit modules (1)

rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_givewp_rce.rb

CVE-2024-5932

Proof-of-concept exploits (9)

Nuclei templates (1)

Metasploit modules (1)

Security advisories

References

Related