CVE-2024-12877
Published: 11 January 2025
Summary
CVE-2024-12877 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Givewp Givewp. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.19.2. The flaw stems from unsafe deserialization of untrusted input supplied through donation form fields such as 'firstName', allowing an attacker to inject a PHP object. A subsequent POP chain enables deletion of arbitrary files on the server, which can be leveraged for remote code execution. The issue is tracked as CWE-502 and received a CVSS 3.1 base score of 9.8.
Unauthenticated attackers can exploit the vulnerability remotely by submitting crafted donation-form data, achieving arbitrary file deletion and remote code execution without requiring authentication, user interaction, or special privileges.
Advisories note that version 3.19.3 contained only a partial fix, while a complete patch was not issued until 3.19.4. The referenced WordPress changeset and Wordfence threat-intel entry document the remediation steps, and the vendor was advised to switch to JSON encoding to eliminate future deserialization risks.
The EPSS score remains flat at a peak of 0.3342 with no material rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51164
Vulnerability details
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 via deserialization of untrusted input from the donation form like 'firstName'. This makes it possible…
more
for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files on the server that makes remote code execution possible. Please note this was only partially patched in 3.19.3, a fully sufficient patch was not released until 3.19.4. However, another CVE was assigned by another CNA for version 3.19.3 so we will leave this as affecting 3.19.2 and before. We have recommended the vendor use JSON encoding to prevent any further deserialization vulnerabilities from being present.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote PHP object injection in public-facing WordPress plugin directly enables exploitation of the application for RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by requiring timely remediation of the deserialization vulnerability through patching the GiveWP plugin to version 3.19.4 or later.
Prevents PHP object injection by enforcing validation and sanitization of untrusted inputs like the 'firstName' donation form field prior to deserialization.
Enables identification of the vulnerable GiveWP plugin versions through regular vulnerability scanning, allowing proactive patching before exploitation.