跳转到帖子

GiveWP Unauthenticated Donation Process Exploit

recommended_posts

发布于
  • Members

GiveWP Unauthenticated Donation Process Exploit

Disclosed
08/25/2024
Created
08/29/2024

Description

The GiveWP Donation Plugin and Fundraising Platform for WordPress, in all versions up to and including 3.16.1, is vulnerable to a PHP Object Injection (POI) attack that allows unauthenticated arbitrary code execution. Although a patch was introduced in version 3.14.2, it was incorrect and can be bypassed. This means the vulnerability remains exploitable in subsequent versions due to the ineffective patch.

Author(s)

  • Villu Orav
  • EQSTLab
  • cuokon
  • Julien Ahrens
  • Valentin Lobstein

Platform

Linux,Unix,Windows

Architectures

cmd

Development

  • Source Code
  • History
  • 查看数 692
  • 已创建
  • 最后回复

参与讨论

你可立刻发布并稍后注册。 如果你有帐户,立刻登录发布帖子。

游客
回帖…