CVE-2024-12877
📋 TL;DR
This vulnerability in the GiveWP WordPress plugin allows unauthenticated attackers to perform PHP object injection via donation form fields, leading to arbitrary file deletion and potential remote code execution. All WordPress sites using GiveWP versions up to 3.19.2 are affected, with partial fixes in 3.19.3 and full remediation in 3.19.4.
💻 Affected Systems
- GiveWP – Donation Plugin and Fundraising Platform for WordPress
📦 What is this software?
Givewp by Givewp
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete server compromise, data theft, and website defacement.
Likely Case
Arbitrary file deletion causing website disruption and potential data loss.
If Mitigated
Limited impact if proper input validation and file permissions are in place.
🎯 Exploit Status
Exploitation requires a POP chain for RCE, but file deletion is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.19.4
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3212723/give/tags/3.19.3/src/Helpers/Utils.php
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find GiveWP and click 'Update Now'. 4. Verify version is 3.19.4 or higher.
🔧 Temporary Workarounds
Disable GiveWP Plugin
allTemporarily disable the vulnerable plugin until patched.
wp plugin deactivate give
Restrict Access to Donation Forms
allUse web application firewall to block suspicious POST requests to donation endpoints.
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all form fields
- Apply principle of least privilege to file system permissions
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for GiveWP version number.Check Version:
wp plugin list --name=give --field=versionVerify Fix Applied:
Confirm GiveWP version is 3.19.4 or higher in WordPress admin.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /wp-json/give/ endpoints with serialized data in parameters
- File deletion events in web server logs
Network Indicators:
- HTTP requests containing serialized PHP objects in donation form submissions
SIEM Query:
source="web_server" AND (uri_path="/wp-json/give/*" AND method="POST" AND (param="firstName" OR param="lastName"))