CVE-2024-37099

CRITICAL

Deserialization of Untrusted Data vulnerability in Liquid Web GiveWP allows Object Injection.This issue affects GiveWP: from n/a through 3.14.1.

Affects 1 product across 1 vendor.

CVSS 3.19.8
EPSS0.6%
Percentile45th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-502: Deserialization of Untrusted Data

Software deserializes untrusted data without validation, allowing crafted objects to execute arbitrary code.

Related Attack Patterns (CAPEC)
CAPEC-586 Object Injection
via CWE-502

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A critical vulnerability in Liquid Web GiveWP, identified as CVE-2024-37099, involves a Deserialization of Untrusted Data flaw that allows for Object Injection. This issue affects versions of GiveWP from n/a through 3.14.1, posing a significant risk to the security of affected systems.

BSID: BS-2024-GLOBAL-196553-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2024-37099?
A critical vulnerability in Liquid Web GiveWP, identified as CVE-2024-37099, involves a Deserialization of Untrusted Data flaw that allows for Object Injection. This issue affects versions of GiveWP from n/a through 3.14.1, posing a significant risk to the security of affected systems.
What is the CVSS score for CVE-2024-37099?
CVE-2024-37099 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 0.6%.
Is CVE-2024-37099 actively exploited?
No confirmed active exploitation of CVE-2024-37099 as of 2026-05-30.
How do I remediate CVE-2024-37099?
Priority: IMMEDIATE.
What systems are affected by CVE-2024-37099?
CVE-2024-37099 affects Givewp Givewp.
Vulnerability Details
CVE IDCVE-2024-37099
BSIDBS-2024-GLOBAL-196553-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2024-08-19
Last Modified2025-02-28
ICS Relevance15%
Weakness (CWE)
Deserialization of Untrusted Data
SourceNVD
Official Description

Deserialization of Untrusted Data vulnerability in Liquid Web GiveWP allows Object Injection.This issue affects GiveWP: from n/a through 3.14.1.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit this vulnerability by injecting maliciously crafted serialized data into the application. This can lead to unauthorized code execution, data theft, or other malicious activities, as the application will deserialize the untrusted data and potentially execute arbitrary code.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Givewp Givewp < 3.14.2
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 787 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashfc96f9a61086a8e740d28387936302d580186092897615d749a625aeb7f647a44654d45eded9e51abe43754030d9a13630f96d632972dbe130c37e716c86e8c8
Related CVEs affecting Givewp
CVE-2023-32513 9.8 Deserialization of Untrusted Data vulnerability in GiveWP GiveWP – Donation P... CVE-2023-0224 9.8 The GiveWP WordPress plugin before 2.24.1 does not properly escape user input... CVE-2019-13578 9.8 A SQL injection vulnerability exists in the Impress GiveWP Give plugin throug... CVE-2023-22719 9.8 Improper Neutralization of Formula Elements in a CSV File vulnerability in Gi... CVE-2024-5932 9.8 The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is...
View all Givewp CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →