CVE-2024-8353

This is a Python-based exploit for CVE-2024-8353, targeting an unauthenticated PHP Object Injection vulnerability in the GiveWP WordPress plugin. It automates the process of retrieving form IDs, nonces, and crafting malicious payloads to achieve remote code execution via deserialization.

This repository contains a Python script and PHP payload to exploit CVE-2024-8353, an unauthenticated PHP Object Injection vulnerability in the GiveWP WordPress plugin (versions up to 3.16.1). The exploit automates the process of identifying vulnerable forms, retrieving nonces, and delivering payloads to achieve remote code execution.

This Metasploit module exploits a PHP Object Injection vulnerability in GiveWP (CVE-2024-8353) to achieve unauthenticated remote code execution. It bypasses an incomplete patch by leveraging a crafted payload in the donation form processing mechanism.