CVE-2024-47315
📋 TL;DR
A Cross-Site Request Forgery (CSRF) vulnerability in the GiveWP WordPress plugin allows attackers to trick authenticated administrators into performing unintended actions. This affects all GiveWP installations from unknown versions through 3.15.1. The vulnerability enables attackers to perform actions on behalf of logged-in users without their consent.
💻 Affected Systems
- GiveWP WordPress Plugin
📦 What is this software?
Givewp by Givewp
⚠️ Risk & Real-World Impact
Worst Case
Attackers could modify donation settings, change payment configurations, or alter plugin behavior leading to financial loss or data exposure.
Likely Case
Attackers could change donation form settings, modify fundraising goals, or alter plugin configurations.
If Mitigated
With proper CSRF protections and user awareness, the risk is significantly reduced as exploitation requires user interaction.
🎯 Exploit Status
Exploitation requires tricking authenticated users into clicking malicious links or visiting compromised sites.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.15.2 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find GiveWP and click 'Update Now'. 4. Verify update completes successfully.
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd custom CSRF protection to GiveWP forms using WordPress nonces
Requires custom WordPress development - no single command
Restrict Admin Access
allLimit administrative access to trusted networks only
Use WordPress security plugins or .htaccess rules to restrict /wp-admin access
🧯 If You Can't Patch
- Disable GiveWP plugin temporarily if not critical
- Implement strict SameSite cookie policies and Content Security Policy headers
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins → GiveWP versionCheck Version:
wp plugin list --name=give --field=version (if WP-CLI installed)Verify Fix Applied:
Verify GiveWP version is 3.15.2 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to GiveWP admin endpoints without referrer validation
- Multiple failed CSRF token validations in WordPress debug logs
Network Indicators:
- External domains making requests to /wp-admin/admin-ajax.php with GiveWP actions
- Suspicious referrer headers in GiveWP-related requests
SIEM Query:
source="wordpress.log" AND ("givewp" OR "give_") AND ("csrf" OR "nonce" OR "referer")