CVE-2024-37099
📋 TL;DR
CVE-2024-37099 is an unauthenticated PHP object injection vulnerability in the GiveWP WordPress plugin. Attackers can exploit deserialization of untrusted data to execute arbitrary code on affected WordPress sites. All WordPress installations using GiveWP versions up to 3.14.1 are vulnerable.
💻 Affected Systems
- WordPress GiveWP Plugin
📦 What is this software?
Givewp by Givewp
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise leading to data theft, ransomware deployment, website defacement, and lateral movement to other systems.
Likely Case
Website takeover, backdoor installation, data exfiltration, and cryptocurrency mining malware deployment.
If Mitigated
Limited impact if proper web application firewalls and intrusion detection systems block exploitation attempts.
🎯 Exploit Status
Public exploit code is available and requires no authentication, making this easily weaponizable.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.14.2 and later
Vendor Advisory: https://wordpress.org/plugins/give/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find GiveWP and click 'Update Now'. 4. Verify version is 3.14.2 or higher.
🔧 Temporary Workarounds
Disable GiveWP Plugin
allTemporarily disable the vulnerable plugin until patching is possible.
wp plugin deactivate give
Web Application Firewall Rule
allBlock malicious requests targeting the vulnerable endpoint.
# Add WAF rule to block requests containing suspicious deserialization patterns
🧯 If You Can't Patch
- Implement strict network segmentation to isolate WordPress servers
- Deploy web application firewall with rules blocking PHP object injection patterns
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → GiveWP version. If version is 3.14.1 or lower, system is vulnerable.Check Version:
wp plugin list --name=give --field=versionVerify Fix Applied:
Verify GiveWP version is 3.14.2 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to GiveWP endpoints
- PHP error logs containing unserialize() warnings
- Web server logs showing exploitation patterns
Network Indicators:
- HTTP requests containing serialized PHP objects
- Traffic spikes to GiveWP plugin endpoints
SIEM Query:
source="web_logs" AND (uri_path="*give*" OR user_agent="*GiveWP*") AND (http_method="POST" AND size_bytes>1000)