GiveWP Unauthenticated RCE: PHP Object Injection & Fix

GiveWP Unauthenticated PHP Object Injection Leads to Remote Code Execution (RCE) Vulnerability Summary Vulnerability Overview Vulnerability Type: Unauthenticated PHP Object Injection → Remote Code Execution (RCE) Affected Plugin: GiveWP (WordPress donation/fundraising plugin) Vulnerability ID/Source: Discovered and reported to Patchstack by Udin Chan Core Mechanism: The attacker injects a serialized object via the field in the donation flow, leveraging magic methods such as / to trigger , ultimately executing arbitrary PHP code. Scope of Impact Affected Versions: GiveWP ≤ 4.16.71 (including 4.16.71) Trigger Conditions: - The site has the (Test Donation) gateway enabled, or there is a published donation form - Attackers can inject objects via the donation flow without logging in - Partially fixed in 4.16.6, but residual risks remain prior to 4.16.71 Impact: Unauthenticated attackers can execute arbitrary PHP code, gaining full control of the server Fix Details Fixed Version: GiveWP 4.16.72 Key Fixes: 1. Added detection for in ; if detected, it returns to prevent incomplete objects from being deserialized 2. Sanitizes the field in to prevent serialized data from being written to the session 3. Filters sessions in the table where is set to , blocking the object injection chain POC / Exploitation Code 1. Injection Point: Field in the Donation Flow 2. Deserialization Helper Function (Flawed) 3. Exploitation Chain: Triggers 4. Fixed Code (4.16.72) 5. Complete Attack Chain (Unauthenticated → RCE) 1. Register Account: POST to to obtain an authentication cookie 2. Plant Gadget: Read the nonce from , then POST the serialized Gadget to the meta field 3. Pollute Session: Submit the form, writing to 4. Trigger Execution: Request any front-end page with the cookie; the server reads the polluted session, deserializes it, and executes , achieving RCE

Goal Reached Thanks to every supporter — we hit 100%!

GiveWP Unauthenticated RCE: PHP Object Injection & Fix