CVE-2024-49332
📋 TL;DR
CVE-2024-49332 is a PHP object injection vulnerability in the Giveaway Boost WordPress plugin that allows attackers to execute arbitrary code through deserialization of untrusted data. This affects all WordPress sites running Giveaway Boost versions up to 2.1.4. Attackers can potentially take full control of vulnerable websites.
💻 Affected Systems
- WordPress Giveaway Boost Plugin
📦 What is this software?
Giveaway Boost by Giveawayboost
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete website compromise, data theft, malware installation, and server takeover.
Likely Case
Website defacement, backdoor installation, credential theft, and unauthorized administrative access.
If Mitigated
Limited impact if proper input validation and WAF rules block malicious payloads.
🎯 Exploit Status
Public exploit details available on Patchstack and security research sites. Attack requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.5 or later
Vendor Advisory: https://patchstack.com/database/vulnerability/giveaway-boost/wordpress-giveaway-boost-plugin-2-1-4-php-object-injection-vulnerability
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Giveaway Boost and click 'Update Now'. 4. Verify version is 2.1.5 or higher.
🔧 Temporary Workarounds
Disable Giveaway Boost Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate giveaway-boost
Web Application Firewall Rule
allBlock malicious serialized data patterns
Add WAF rule to block requests containing 'O:' followed by numbers (PHP object serialization patterns)
🧯 If You Can't Patch
- Remove Giveaway Boost plugin completely from production environment
- Implement strict input validation and sanitization for all user-controlled data
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Giveaway Boost version. If version is 2.1.4 or lower, you are vulnerable.Check Version:
wp plugin get giveaway-boost --field=versionVerify Fix Applied:
Verify Giveaway Boost plugin version is 2.1.5 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to WordPress endpoints, PHP unserialize() errors in logs, unexpected file uploads or modifications
Network Indicators:
- HTTP requests containing serialized PHP objects (patterns like O:8:"stdClass") to WordPress admin-ajax.php or similar endpoints
SIEM Query:
source="wordpress.log" AND ("unserialize" OR "O:" AND "giveaway")