CVE-2024-5932

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

10.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

74.28% chance of exploitation in the next 30 days, 99th percentile

Nuclei

critical · CWE-502

Published

2024-08-20

Updated

2026-04-08

Proof-of-concept exploits (9)

• 0xb0mb3r/CVE-2024-5932-PoC3★ · 2024-12-13
• 0xb0mb3r/CVE-2024-8353-PoC3★ · 2024-12-13
• EQSTLab/CVE-2024-593277★ · 2025-01-12
• EQSTLab/CVE-2024-835312★ · 2024-10-01
• OxLmahdi/cve-2024-59321★ · 2024-10-11
• hlc23/CVE-2024-5932-web-ui0★ · 2025-08-15
• tk-1001/PHPexploit_pack0★ · 2025-06-04
• autom4il/CVE-2024-5932
• nishant-kumar-5173/CVE-2024-5932

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5932.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_givewp_rce.rb

References

• CVE Record
• NVD entry

Related

• CVE-2024-8353
• CVE-2023-3824
• CVE-2024-4577
• CVE-2024-5921
• CVE-2024-5936
• CVE-2024-5910