CVE-2025-22777

CriticalRCE

Published: 13 January 2025

Published

13 January 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0055 68.2th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-22777 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Givewp Givewp. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 31.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Timely flaw remediation via patching the deserialization vulnerability in GiveWP plugin versions <=3.19.3 directly prevents remote unauthenticated object injection exploitation.

SI-10 Information Input Validation good match

prevent

Validates untrusted input data before deserialization in the GiveWP plugin to block malicious object injection payloads.

SI-3 Malicious Code Protection partial match

preventdetect

Malicious code protection detects and prevents execution of code resulting from successful object injection in the vulnerable GiveWP plugin.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

Unauthenticated PHP Object Injection in public-facing WordPress GiveWP plugin enables T1190 (Exploit Public-Facing Application) for potential RCE/code injection/SQLi/path traversal, and facilitates T1499.004 (Application or System Exploitation) for denial of service.

NVD Description

Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give allows Object Injection.This issue affects GiveWP: from n/a through <= 3.19.3.

Deeper analysisAI

CVE-2025-22777 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the StellarWP GiveWP plugin for WordPress, enabling object injection. The issue affects all versions of GiveWP up to and including 3.19.3. Published on January 13, 2025, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical due to its potential for severe impact.

Remote, unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows attackers to achieve high levels of impact on confidentiality, integrity, and availability, potentially leading to full system compromise through object injection in PHP.

Advisories from Patchstack and SecurityOnline detail the vulnerability and recommend mitigation; security practitioners should consult these sources for patch availability and update instructions for affected GiveWP installations.

The GiveWP plugin has over 100,000 active WordPress installations, amplifying the potential exposure of this critical flaw. No public information on real-world exploitation is available in the provided details.