CVE-2024-30229: high-severity vulnerability in StellarWP GiveWP
WordPress Give plugin <= 3.4.2 - PHP Object Injection vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It exploitation observed by VulnCheck.
The WordPress Give plugin has a flaw that allows attackers to inject malicious code by sending specially crafted data. An attacker can exploit this to take control of the website or steal sensitive information.
A PHP object injection vulnerability in GiveWP <= 3.4.2 stems from unsafe deserialization of untrusted user-supplied data. An attacker can craft malicious serialized objects to execute arbitrary code with the privileges of the web server, potentially leading to remote code execution or data exfiltration.
In the same product, most dangerous first.