CVE-2024-5932
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input ...
Affects 1 product across 1 vendor.
Software deserializes untrusted data without validation, allowing crafted objects to execute arbitrary code.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection via the 'give_title' parameter, allowing unauthenticated attackers to execute remote code and delete arbitrary files. This vulnerability has a CVSS score of 9.8, indicating a critical risk level. Immediate action is required to mitigate the risk of exploitation.
BSID: BS-2024-GLOBAL-268333-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2024-5932?
What is the CVSS score for CVE-2024-5932?
Is CVE-2024-5932 actively exploited?
How do I remediate CVE-2024-5932?
What systems are affected by CVE-2024-5932?
What NERC-CIP standard applies to CVE-2024-5932?
What IEC 62443 requirement maps to CVE-2024-5932?
| CVE ID | CVE-2024-5932 |
|---|---|
| BSID | BS-2024-GLOBAL-268333-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2024-08-20 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 15% |
| Weakness (CWE) | |
| Source | NVD |
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.
Source: NIST NVD / MITRE CVE Database
The vulnerability arises from the deserialization of untrusted input in the 'give_title' parameter. An unauthenticated attacker can inject a PHP object, which, combined with a POP chain, can lead to remote code execution and file deletion. The presence of a public proof of concept (PoC) increases the likelihood of exploitation.
Exploitation Likelihood: CRITICAL
| Vendor | Product | Affected Versions |
|---|---|---|
| Givewp | Givewp | < 3.14.2 |
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Implement input validation and sanitization for the 'give_title' parameter. Ensure that only trusted input is processed and that object deserialization is disabled or restricted.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.
This vulnerability violates CIP-007-R2, which requires the protection of critical cyber assets from unauthorized access and malicious activity. The PHP Object Injection can lead to remote code execution, compromising the integrity and availability of the system.
This vulnerability maps to SR 7.6, which requires the implementation of secure coding practices to prevent the injection of malicious code. The PHP Object Injection vulnerability can be exploited to execute arbitrary code, violating this security requirement.
Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.
AI Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | c2da84c9bc052bf000033bc9d2198c223d02785195346efb50f11cb5b70348de09b452b62e647d4cb9803879abc9fd4da73a8b8cf6abfbc6f1c2653119025d7a |
Critical Severity - Know Your Exposure
A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →