Unauthenticated PHP Object Injection in GiveWP Donation and Donor Meta

GiveWP up to 3.19.4 wrote donation-form fields such as the billing address (card_address) straight into its donation and donor meta tables, bypassing WordPress meta serialisation. A serialised PHP object submitted by an unauthenticated donor is therefore instantiated whenever that meta is read back, which can lead to remote code execution if a POP chain is present on the site.

This vulnerability affects the following application versions:

• GiveWP – Donation Plugin 2.19.6
• GiveWP – Donation Plugin 2.19.7
• GiveWP – Donation Plugin 2.19.8
• GiveWP – Donation Plugin 2.20.0
• GiveWP – Donation Plugin 2.20.1
• GiveWP – Donation Plugin 2.20.2
• GiveWP – Donation Plugin 2.21.0
• GiveWP – Donation Plugin 2.21.1
• GiveWP – Donation Plugin 2.21.2
• GiveWP – Donation Plugin 2.21.3
• GiveWP – Donation Plugin 2.21.4
• GiveWP – Donation Plugin 2.22.0
• GiveWP – Donation Plugin 2.22.1
• GiveWP – Donation Plugin 2.22.2
• GiveWP – Donation Plugin 2.22.3
• GiveWP – Donation Plugin 2.23.0
• GiveWP – Donation Plugin 2.23.1
• GiveWP – Donation Plugin 2.23.2
• GiveWP – Donation Plugin 2.24.0
• GiveWP – Donation Plugin 2.24.1
• GiveWP – Donation Plugin 2.24.2
• GiveWP – Donation Plugin 2.25.0
• GiveWP – Donation Plugin 2.25.1
• GiveWP – Donation Plugin 2.25.2
• GiveWP – Donation Plugin 2.25.3
• GiveWP – Donation Plugin 2.26.0
• GiveWP – Donation Plugin 2.27.0
• GiveWP – Donation Plugin 2.27.1
• GiveWP – Donation Plugin 2.27.2
• GiveWP – Donation Plugin 2.27.3
• GiveWP – Donation Plugin 2.28.0
• GiveWP – Donation Plugin 2.29.0
• GiveWP – Donation Plugin 2.29.1
• GiveWP – Donation Plugin 2.29.2
• GiveWP – Donation Plugin 2.30.0
• GiveWP – Donation Plugin 2.31.0
• GiveWP – Donation Plugin 2.31.1
• GiveWP – Donation Plugin 2.32.0
• GiveWP – Donation Plugin 2.33.0
• GiveWP – Donation Plugin 2.33.1
• GiveWP – Donation Plugin 2.33.2
• GiveWP – Donation Plugin 2.33.3
• GiveWP – Donation Plugin 2.33.4
• GiveWP – Donation Plugin 2.33.5
• GiveWP – Donation Plugin 3.0.0
• GiveWP – Donation Plugin 3.0.1
• GiveWP – Donation Plugin 3.0.2
• GiveWP – Donation Plugin 3.0.3
• GiveWP – Donation Plugin 3.0.4
• GiveWP – Donation Plugin 3.1.0
• GiveWP – Donation Plugin 3.1.1
• GiveWP – Donation Plugin 3.1.2
• GiveWP – Donation Plugin 3.2.0
• GiveWP – Donation Plugin 3.2.1
• GiveWP – Donation Plugin 3.2.2
• GiveWP – Donation Plugin 3.3.0
• GiveWP – Donation Plugin 3.3.1
• GiveWP – Donation Plugin 3.4.0
• GiveWP – Donation Plugin 3.4.1
• GiveWP – Donation Plugin 3.4.2
• GiveWP – Donation Plugin 3.5.0
• GiveWP – Donation Plugin 3.5.1
• GiveWP – Donation Plugin 3.6.0
• GiveWP – Donation Plugin 3.6.1
• GiveWP – Donation Plugin 3.6.2
• GiveWP – Donation Plugin 3.7.0
• GiveWP – Donation Plugin 3.8.0
• GiveWP – Donation Plugin 3.9.0
• GiveWP – Donation Plugin 3.10.0
• GiveWP – Donation Plugin 3.11.0
• GiveWP – Donation Plugin 3.12.0
• GiveWP – Donation Plugin 3.12.1
• GiveWP – Donation Plugin 3.12.2
• GiveWP – Donation Plugin 3.12.3
• GiveWP – Donation Plugin 3.13.0
• GiveWP – Donation Plugin 3.14.0
• GiveWP – Donation Plugin 3.14.1
• GiveWP – Donation Plugin 3.14.2
• GiveWP – Donation Plugin 3.15.0
• GiveWP – Donation Plugin 3.15.1
• GiveWP – Donation Plugin 3.16.0
• GiveWP – Donation Plugin 3.16.1
• GiveWP – Donation Plugin 3.16.2
• GiveWP – Donation Plugin 3.16.3
• GiveWP – Donation Plugin 3.16.4
• GiveWP – Donation Plugin 3.16.5
• GiveWP – Donation Plugin 3.17.0
• GiveWP – Donation Plugin 3.17.1
• GiveWP – Donation Plugin 3.17.2
• GiveWP – Donation Plugin 3.18.0
• GiveWP – Donation Plugin 3.19.0
• GiveWP – Donation Plugin 3.19.1
• GiveWP – Donation Plugin 3.19.2
• GiveWP – Donation Plugin 3.19.3
• GiveWP – Donation Plugin 3.19.4