// CVE-2024-5932 · UNAUTH RCE · DESERIALIZATION
GiveWP got hit?
We clean up.
An unauthenticated PHP object-injection in GiveWP let attackers run code on the server. Public PoC, mass scanning, exploited at scale starting August 2024. If your site ran an affected version, get a forensic look. Flat $279.
§ 01 — WHAT THE BUG WAS
User input → unserialize() → RCE via POP gadget.
GiveWP's donation form accepted a give_title parameter that ended up in PHP's unserialize() function. The plugin's codebase contained a chain of classes (a 'POP gadget chain') that, when triggered through that unserialize call, produced arbitrary code execution. No authentication required.
Affected: versions prior to 3.14.2. Disclosed August 7, 2024 with a working PoC. Patch was straightforward but install rollout was uneven — many sites stayed exposed for days.
§ 02 — INDICATORS
What we look at.
[ ACCESS LOG ]
POSTs to /?give_action=donation or admin-ajax.php with give_title containing serialized PHP (starts with O:, a:, s:). Surprisingly clear in logs.
[ FILES ]
Fresh PHP in wp-content/uploads/ or anywhere outside the GiveWP plugin folder after August 2024.
[ USERS ]
Admin accounts created since the disclosure. Often the immediate payload of the RCE.
[ ACTIVE_PLUGINS ]
wp_options active_plugins row containing plugins you didn't install. Frequently file-manager-style plugins used as a second-stage web shell.
§ PRICE
Flat $279. One-time. Per site.
[ RESCUE ]
$279
PLANO · ÚNICO · POR SITIO
Limpieza manual, identificación del vector, informe forense escrito. Garantía de reinfección 30 días.
Iniciar limpieza →[ SHIELD ]
$29 / mo
POR SITIO · CANCELA CUANDO QUIERAS
Monitorización continua, endurecimiento, una limpieza al año incluida.
Protégete →¿Sitio comprometido? Abre un encargo.
Send us what you know. You get a triage and a fixed quote in return — no obligation.