Critical PHP Object Injection in GiveWP Plugin Leads to Unauthenticated Remote Code Execution

A critical unauthenticated PHP Object Injection vulnerability, rated with a CVSS score of 10.0, has been discovered in the GiveWP WordPress plugin, affecting versions 4.16.7.1 and earlier. This flaw enables attackers to execute arbitrary commands on vulnerable servers without requiring any prior authentication or user privileges.

The vulnerability is particularly concerning as it can be exploited on a default installation of WordPress with the GiveWP plugin. Attackers only need a published donation form and an active payment gateway to initiate the exploit. While later versions (4.16.6 through 4.16.7.1) have a slightly narrowed attack vector due to changes in the legacy donation processor, the vulnerability remains exploitable on sites upgraded from older versions, those that import or restore forms, or where administrators have enabled a specific form editor setting.

The exploit chain relies on three key components: a flawed "safe unserialize" helper function within GiveWP, a donation flow that allows attackers to inject controlled data, and a gadget chain present in the plugin's code. The maybeSafeUnserialize function in src/Helpers/Utils.php attempts to sanitize data but fails to prevent object injection. Instead of removing malicious objects, it replaces them with __PHP_Incomplete_Class placeholders, preserving the original object's class name and properties. This placeholder is then serialized and stored, effectively deferring the actual deserialization and exploitation to a later stage.

The second part of the chain involves the donation process itself. An attacker can store serialized malicious data in their user meta, specifically the last_name field. When a donation is submitted, the plugin processes this user information, including the attacker-controlled data, and passes it through the maybeSafeUnserialize helper. This results in the malicious object being stored in the wp_give_sessions table as a __PHP_Incomplete_Class placeholder.

The final stage of the attack is triggered when the session data is later read from the database. This time, the data is unserialized without the allowed_classes restriction, bringing the malicious object to life. The presence of a gadget chain, formed by combining the TCPDF library and GiveTestData classes shipped with GiveWP, allows for the execution of dangerous functions when the injected object is destroyed or serialized, ultimately leading to remote code execution.

Patchstack, a security firm, has released mitigation rules to protect websites from this threat. The vulnerability was discovered and reported by security researcher Udin Chan. Users of GiveWP are strongly advised to update to the latest version to patch this critical vulnerability and prevent potential compromise of their WordPress sites.

This incident highlights the ongoing risks associated with complex plugins that handle sensitive user data and financial transactions. Developers must prioritize secure coding practices, particularly around data deserialization, and thoroughly vet third-party libraries to prevent such critical vulnerabilities from impacting their users.