GiveWP up to 3.19.4 wrote donation-form fields such as the billing address (card_address) straight into its donation and donor meta tables, bypassing WordPress meta serialisation. A serialised PHP object submitted by an unauthenticated donor is therefore instantiated whenever that meta is read back, which can lead to remote code execution if a POP chain is present on the site.
This vulnerability affects the following application versions:
- GiveWP – Donation Plugin 2.19.6
- GiveWP – Donation Plugin 2.19.7
- GiveWP – Donation Plugin 2.19.8
- GiveWP – Donation Plugin 2.20.0
- GiveWP – Donation Plugin 2.20.1
- GiveWP – Donation Plugin 2.20.2
- GiveWP – Donation Plugin 2.21.0
- GiveWP – Donation Plugin 2.21.1
- GiveWP – Donation Plugin 2.21.2
- GiveWP – Donation Plugin 2.21.3
- GiveWP – Donation Plugin 2.21.4
- GiveWP – Donation Plugin 2.22.0
- GiveWP – Donation Plugin 2.22.1
- GiveWP – Donation Plugin 2.22.2
- GiveWP – Donation Plugin 2.22.3
- GiveWP – Donation Plugin 2.23.0
- GiveWP – Donation Plugin 2.23.1
- GiveWP – Donation Plugin 2.23.2
- GiveWP – Donation Plugin 2.24.0
- GiveWP – Donation Plugin 2.24.1
- GiveWP – Donation Plugin 2.24.2
- GiveWP – Donation Plugin 2.25.0
- GiveWP – Donation Plugin 2.25.1
- GiveWP – Donation Plugin 2.25.2
- GiveWP – Donation Plugin 2.25.3
- GiveWP – Donation Plugin 2.26.0
- GiveWP – Donation Plugin 2.27.0
- GiveWP – Donation Plugin 2.27.1
- GiveWP – Donation Plugin 2.27.2
- GiveWP – Donation Plugin 2.27.3
- GiveWP – Donation Plugin 2.28.0
- GiveWP – Donation Plugin 2.29.0
- GiveWP – Donation Plugin 2.29.1
- GiveWP – Donation Plugin 2.29.2
- GiveWP – Donation Plugin 2.30.0
- GiveWP – Donation Plugin 2.31.0
- GiveWP – Donation Plugin 2.31.1
- GiveWP – Donation Plugin 2.32.0
- GiveWP – Donation Plugin 2.33.0
- GiveWP – Donation Plugin 2.33.1
- GiveWP – Donation Plugin 2.33.2
- GiveWP – Donation Plugin 2.33.3
- GiveWP – Donation Plugin 2.33.4
- GiveWP – Donation Plugin 2.33.5
- GiveWP – Donation Plugin 3.0.0
- GiveWP – Donation Plugin 3.0.1
- GiveWP – Donation Plugin 3.0.2
- GiveWP – Donation Plugin 3.0.3
- GiveWP – Donation Plugin 3.0.4
- GiveWP – Donation Plugin 3.1.0
- GiveWP – Donation Plugin 3.1.1
- GiveWP – Donation Plugin 3.1.2
- GiveWP – Donation Plugin 3.2.0
- GiveWP – Donation Plugin 3.2.1
- GiveWP – Donation Plugin 3.2.2
- GiveWP – Donation Plugin 3.3.0
- GiveWP – Donation Plugin 3.3.1
- GiveWP – Donation Plugin 3.4.0
- GiveWP – Donation Plugin 3.4.1
- GiveWP – Donation Plugin 3.4.2
- GiveWP – Donation Plugin 3.5.0
- GiveWP – Donation Plugin 3.5.1
- GiveWP – Donation Plugin 3.6.0
- GiveWP – Donation Plugin 3.6.1
- GiveWP – Donation Plugin 3.6.2
- GiveWP – Donation Plugin 3.7.0
- GiveWP – Donation Plugin 3.8.0
- GiveWP – Donation Plugin 3.9.0
- GiveWP – Donation Plugin 3.10.0
- GiveWP – Donation Plugin 3.11.0
- GiveWP – Donation Plugin 3.12.0
- GiveWP – Donation Plugin 3.12.1
- GiveWP – Donation Plugin 3.12.2
- GiveWP – Donation Plugin 3.12.3
- GiveWP – Donation Plugin 3.13.0
- GiveWP – Donation Plugin 3.14.0
- GiveWP – Donation Plugin 3.14.1
- GiveWP – Donation Plugin 3.14.2
- GiveWP – Donation Plugin 3.15.0
- GiveWP – Donation Plugin 3.15.1
- GiveWP – Donation Plugin 3.16.0
- GiveWP – Donation Plugin 3.16.1
- GiveWP – Donation Plugin 3.16.2
- GiveWP – Donation Plugin 3.16.3
- GiveWP – Donation Plugin 3.16.4
- GiveWP – Donation Plugin 3.16.5
- GiveWP – Donation Plugin 3.17.0
- GiveWP – Donation Plugin 3.17.1
- GiveWP – Donation Plugin 3.17.2
- GiveWP – Donation Plugin 3.18.0
- GiveWP – Donation Plugin 3.19.0
- GiveWP – Donation Plugin 3.19.1
- GiveWP – Donation Plugin 3.19.2
- GiveWP – Donation Plugin 3.19.3
- GiveWP – Donation Plugin 3.19.4