Medium severity5.4NVD Advisory· Published Jul 19, 2024· Updated Jun 17, 2026

CVE-2024-5977

Description

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.13.0 via the 'handleRequest' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with GiveWP Worker-level access and above, to delete and update arbitrary posts.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Givewpllm-fuzzy2 versions
<=3.13.0+ 1 more
- (no CPE)range: <=3.13.0
- (no CPE)
stellarwp/GiveWP – Donation Plugin and Fundraising Platformv5
Range: 0

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/browser/give/trunk/src/DonationForms/V2/Endpoints/FormActions.phpnvdPatch
plugins.trac.wordpress.org/changeset/3120745/nvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/2dca6c29-9f05-4d82-90e3-834f1dd8005anvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000