WordPress security changelog
HIGH CVE-2023-32513 Modified

GiveWP – Donation Plugin and Fundraising Platform: Code execution

GiveWP – Donation Plugin and Fundraising Platform is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

CVE / CNA score 7.5 CVSS 3.1 · audit@patchstack.com
NVD score 9.8 CVSS 3.1 · nvd@nist.gov
Component
GiveWP – Donation Plugin and Fundraising Platform
Plugin slug
give
Affected
See vendor advisory
Safe version
See mitigation notes
Published
Dec 28, 2023
Weakness
CWE-502 — Deserialization of Untrusted Data

This CVE was published Dec 28, 2023 and is one of 45 known issues for this plugin.

What to do

Patch or disable the affected component.

Update GiveWP – Donation Plugin and Fundraising Platform to a release outside the affected range, or disable and remove it until a fixed version is available.

Source record

Technical description

Deserialization of Untrusted Data vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.3.

CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources