CVE-2024-8353 – This vulnerability allows unauthenticated attac... (How to Fix)

Q: What is the severity of CVE-2024-8353?

CVE-2024-8353 has a CVSS score of 10.0 (CRITICAL). This vulnerability allows unauthenticated attackers to perform PHP object injection in the GiveWP WordPress plugin, leading to arbitrary file deletion and remote code execution. All WordPress sites using GiveWP versions up to 3.16.1 are affected. The vulnerability stems from insecure deserialization of user-controlled input in donation processing parameters.

📋 TL;DR

This vulnerability allows unauthenticated attackers to perform PHP object injection in the GiveWP WordPress plugin, leading to arbitrary file deletion and remote code execution. All WordPress sites using GiveWP versions up to 3.16.1 are affected. The vulnerability stems from insecure deserialization of user-controlled input in donation processing parameters.

💻 Affected Systems

Products:

GiveWP - Donation Plugin and Fundraising Platform for WordPress

Versions: All versions up to and including 3.16.1

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: WordPress sites with the GiveWP plugin installed and active are vulnerable by default

📦 What is this software?

Givewp by Givewp

View all CVEs affecting Givewp →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete site compromise including remote code execution, data theft, and website defacement

🟠

Likely Case

Arbitrary file deletion leading to site disruption and potential privilege escalation to RCE

🟢

If Mitigated

Limited impact with proper input validation and file permissions in place

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation is straightforward due to unauthenticated access and known POP chain

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 3.16.2

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3157829/give/tags/3.16.2/includes/process-donation.php

Restart Required: No

Instructions:

1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find GiveWP plugin
4. Click 'Update Now' if available
5. If no update available, download version 3.16.2+ from WordPress.org
6. Deactivate old plugin, upload new version, activate

🔧 Temporary Workarounds

Disable GiveWP Plugin

all

Temporarily disable the vulnerable plugin until patching is possible

wp plugin deactivate give

Web Application Firewall Rule

all

Block requests containing serialized PHP objects in donation parameters

ModSecurity rule: SecRule ARGS "@rx O:[0-9]+:" "id:1001,phase:2,deny,msg:'PHP Object Injection Attempt'"
Cloudflare WAF: Create rule to block requests with 'give_title' or 'card_address' containing serialized data

🧯 If You Can't Patch

Disable the GiveWP plugin immediately
Implement strict input validation at the web server level to block serialized data

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Installed Plugins for GiveWP version. If version is 3.16.1 or lower, you are vulnerable.

Check Version:

wp plugin list --name=give --field=version

Verify Fix Applied:

Verify GiveWP plugin version is 3.16.2 or higher in WordPress admin panel

📡 Detection & Monitoring

Log Indicators:

POST requests to /wp-admin/admin-ajax.php with 'give_title' or 'card_address' parameters containing serialized data
Unexpected file deletion events in WordPress uploads directory
PHP errors related to unserialize() or object injection

Network Indicators:

HTTP requests with serialized PHP objects in donation form parameters
Unusual outbound connections from WordPress server post-exploitation

SIEM Query:

source="wordpress.log" AND ("give_title" OR "card_address") AND ("O:" OR "a:" OR "s:" OR "i:" OR "d:")

📊 Metadata

CVE ID: CVE-2024-8353

CVSS v3 Score: 10.0 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE: CWE-502

Published: September 28, 2024

Last Updated: October 1, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-8353, you might also want to check these: