CVE-2025-22777
Published: 13 January 2025
Summary
CVE-2025-22777 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Givewp Givewp. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 26.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-22777 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the StellarWP GiveWP plugin for WordPress, enabling object injection. The issue affects all versions of GiveWP up to and including 3.19.3. Published on January 13, 2025, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical due to its potential for severe impact.
Remote, unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows attackers to achieve high levels of impact on confidentiality, integrity, and availability, potentially leading to full system compromise through object injection in PHP.
Advisories from Patchstack and SecurityOnline detail the vulnerability and recommend mitigation; security practitioners should consult these sources for patch availability and update instructions for affected GiveWP installations.
The GiveWP plugin has over 100,000 active WordPress installations, amplifying the potential exposure of this critical flaw. No public information on real-world exploitation is available in the provided details.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2987
Vulnerability details
Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give allows Object Injection.This issue affects GiveWP: from n/a through <= 3.19.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated PHP Object Injection in public-facing WordPress GiveWP plugin enables T1190 (Exploit Public-Facing Application) for potential RCE/code injection/SQLi/path traversal, and facilitates T1499.004 (Application or System Exploitation) for denial of service.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely flaw remediation via patching the deserialization vulnerability in GiveWP plugin versions <=3.19.3 directly prevents remote unauthenticated object injection exploitation.
Validates untrusted input data before deserialization in the GiveWP plugin to block malicious object injection payloads.
Malicious code protection detects and prevents execution of code resulting from successful object injection in the vulnerable GiveWP plugin.