CVE-2024-9634

The vulnerability present in the GiveWP Donation Plugin and Fundraising Platform for WordPress is characterized by a PHP Object Injection flaw, which arises from the deserialization of untrusted input. Specifically, this vulnerability is triggered through the manipulation of the give_company_name parameter. When an attacker sends crafted input that the application does not properly validate, it allows for the injection of arbitrary PHP objects. This flaw is particularly severe due to the presence of a Property-Oriented Programming (POP) chain, which enables attackers to execute arbitrary code on the server. The potential for remote code execution elevates the risk associated with this vulnerability, making it critical for users of the affected plugin to take immediate action.

Attack vectors for exploiting this vulnerability are relatively straightforward, given that unauthenticated attackers can leverage it without needing any special access or credentials. An attacker could craft a malicious request that includes a specially formatted payload in the give_company_name parameter. Upon receiving this input, the vulnerable application would deserialize the data, leading to the execution of arbitrary PHP code. This could allow the attacker to perform a variety of malicious actions, such as creating new administrative accounts, exfiltrating sensitive data, or even taking complete control of the affected WordPress site. The ease of exploitation, combined with the high impact of the vulnerability, makes it a prime target for attackers seeking to compromise WordPress installations.

The real-world impact of this vulnerability is significant, particularly for organizations that rely on the GiveWP plugin for fundraising and donation management. Successful exploitation could lead to unauthorized access to sensitive donor information, financial data, and other critical resources. This not only poses a direct financial risk but also threatens the organization's reputation and trustworthiness. For non-profit organizations, where donor trust is paramount, a breach could result in a loss of funding and support. Additionally, the potential for widespread exploitation means that many organizations using this plugin could be at risk, leading to a broader impact across the WordPress ecosystem.

To detect and mitigate the risks associated with this vulnerability, organizations should implement a multi-faceted approach. First and foremost, updating the GiveWP plugin to the latest version is essential, as this will patch the vulnerability and protect against exploitation. Regularly monitoring and auditing web applications for vulnerabilities is also crucial, as it allows organizations to identify and address potential security issues before they can be exploited. Employing web application firewalls (WAFs) can provide an additional layer of defense by filtering out malicious requests before they reach the application. Furthermore, organizations should conduct security awareness training for their staff to ensure they understand the importance of input validation and secure coding practices.

In conclusion, the PHP Object Injection vulnerability in the GiveWP Donation Plugin represents a serious threat to WordPress users, particularly those in the non-profit sector. The potential for remote code execution, combined with the ease of exploitation, necessitates immediate attention from affected organizations. By prioritizing updates, implementing robust security practices, and fostering a culture of security awareness, organizations can significantly reduce their risk and protect their valuable assets from malicious actors.

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting the PHP Object Injection vulnerability in the GiveWP Donation Plugin. Our telemetry indicates a doubling in detection frequency, signaling increased attacker interest and activity. Although no new exploit variants or proof-of-concept code have surfaced, the sustained rise in exploitation attempts underscores the vulnerability’s attractiveness as a vector for remote code execution. This trend elevates the threat level, particularly for WordPress environments that remain unpatched, as adversaries may be refining their attack chains or expanding targeting scope. Defenders should interpret this surge as a clear indicator of heightened risk, reflecting adversaries’ ongoing efforts to leverage this critical flaw in real-world scenarios.

Update 2 — July 18, 2026

CSURFACE threat intelligence has identified a marked escalation in exploitation attempts targeting the GiveWP plugin vulnerability, with our telemetry showing a sustained upward trend in attack activity. This increase, while not accompanied by new exploit variants or publicly disclosed proof-of-concept code, suggests adversaries are intensifying their operational focus on this critical flaw. The persistence and growth in exploitation attempts indicate that threat actors may be refining their payload delivery or expanding their targeting strategies, potentially increasing the likelihood of successful remote code execution in vulnerable WordPress environments. Although the EPSS score remains stable, the qualitative surge in attack frequency elevates the overall threat posture, underscoring the urgency for defenders to maintain heightened vigilance. This evolving landscape reflects a growing adversary interest that could presage more sophisticated or widespread exploitation efforts in the near term.