CVE-2024-8353criticalexploração observadaCWE-502

CVE-2024-8353: falha crítica em stellarwp GiveWP – Donation Plugin and…

GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar GiveWP – Donation Plugin and Fundraising Platform

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

97Vexday Risk Score

Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.

ssvc Actcvss 9.8epss 33%
da publicação à armano mesmo dia
Publicada no NVD28 de set.
1ª PoC21 de ago.
metasploit25 de ago.
VulnCheck+180d
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like 'give_title' and 'card_address'. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files and achieve remote code execution. This is essentially the same vulnerability as CVE-2024-5932, however, it was discovered the the presence of stripslashes_deep on user_info allows the is_serialized check to be bypassed. This issue was mostly patched in 3.16.1, but further hardening was added in 3.16.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
stellarwp · GiveWP – Donation Plugin and Fundraising Platform
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — stellarwp GiveWP – Donation Plugin and…

No mesmo produto, das mais perigosas para as menos.

CVE-2024-5932CRITICALGiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code ExecutionEPSS 76.8%CVE-2025-0912CRITICALGiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object InjectionEPSS 1.4%CVE-2024-9634CRITICALGiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code ExecutionEPSS 1.4%CVE-2024-12877CRITICALGiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object InjectionEPSS 1.2%CVE-2022-2117MEDIUMGiveWP – Donation Plugin and Fundraising Platform <= 2.20.2 - Sensitive Information DisclosureEPSS 1.2%CVE-2024-9130HIGHGiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Authenticated (GiveWP Manager+) SQL Injection via order ParameterEPSS 0.7%