CVE-2024-8353Givewp Insecure Deserialization
GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection
Published Sep 30, 2024 · Updated Apr 8, 2026 · Also known as WORDFENCE-c4c530fa-eaf4-4721-bfb6-9fc06d7f343c, c4c530fa-eaf4-4721-bfb6-9fc06d7f343c
Key Facts
Patch immediately- CVE-2024-8353 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Givewp, give (wordpress-plugin), GiveWP – Donation Plugin and Fundraising Platform.
- It is exploited in the wild, listed in Industry KEV feed since Mar 27, 2025. Public exploit code is available.
- EPSS estimates a 29% probability of exploitation in the next 30 days.
- Fixed versions are available, including give 3.16.2, Givewp 3.16.2.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Scores
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
29%
Higher than 98.1% of all scored CVEs
Exploit maturity
Weaponized
ATLAS score
56/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Mar 27, 2025
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Weaponized
Public exploit code
1
Proof-of-concept links
In-the-wild evidence
2
Reports of active use
Advisories And Exploit References
- advisoryhttps://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/trunk/includes/compatibility/widgets/grid.php#L72
- advisoryhttps://plugins.trac.wordpress.org/browser/wp-multitasking/trunk/wp-multitasking.php#L29
- advisoryhttps://plugins.trac.wordpress.org/browser/wp-multitasking/trunk/wp-multitasking.php#L71
- advisoryhttps://plugins.trac.wordpress.org/changeset/3150170/
- advisoryhttps://plugins.trac.wordpress.org/changeset/3158305/
- advisoryhttps://wordpress.org/plugins/premium-addons-for-elementor/#developers
Description
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like 'give_title' and 'card_address'. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files and achieve remote code execution.
This is essentially the same vulnerability as CVE-2024-5932, however, it was discovered the the presence of stripslashes_deep on user_info allows the is_serialized check to be bypassed. This issue was mostly patched in 3.16.1, but further hardening was added in 3.16.2.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| Industry KEV feed | Mar 27, 2025 | n/a | Not reported |
Affected Products
3 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| GivewpGivewp | See advisory | 3.16.2 |
| givewordpress-plugin | See advisory | 3.16.2 |
| GiveWP – Donation Plugin and Fundraising Platform | See advisory | n/a |
Patched Releases
give
3.16.2
Givewp
3.16.2
Timeline
Publicly disclosed
Sep 30, 2024
Added to Industry KEV feed
Mar 27, 2025
Last updated
Apr 8, 2026
Weakness Type
- CWE-502 Deserialization of Untrusted Data
References
- advisoryplugins.trac.wordpress.org · grid.php
- advisoryplugins.trac.wordpress.org · wp-multitasking.php
- advisoryplugins.trac.wordpress.org · wp-multitasking.php
- advisoryplugins.trac.wordpress.org · 3150170
- advisoryplugins.trac.wordpress.org · 3158305
FAQ
Common Questions.
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like 'give_title' and 'card_address'.
Affected: Givewp; give (wordpress-plugin); GiveWP – Donation Plugin and Fundraising Platform. The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed since Mar 27, 2025.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including give 3.16.2, Givewp 3.16.2.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2024-8353 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo