CVE-2024-8353

Summary

CVE-2024-8353 is a critical vulnerability affecting the GiveWP – Donation Plugin and Fundraising Platform for WordPress. This issue, which allows unauthenticated attackers to inject PHP Objects through deserialization of untrusted inputs, is present in all versions up to 3.16.1. The vulnerability can be exploited via several parameters, including 'give_title' and 'card_address'. An attacker can utilize this vulnerability to delete arbitrary files and achieve remote code execution, thanks to a POP chain. Although 3.16.1 includes some patches, further hardening measures were implemented in version 3.16.2. Essentially, this vulnerability shares similarities with CVE-2024-5932; however, the presence of stripslashes_deep on user_info enables the bypassing of the is_serialized check.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.