CVE-2024-8353

CRITICAL EXPLOITED NUCLEI

GiveWP Unauthenticated Donation Process Exploit

Title source: metasploit
STIX 2.1

Exploitation Summary

CVE-2024-8353 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 3 public exploits from researchers including EQSTLab, 0xb0mb3r, Villu Orav, EQSTLab, cuokon, Julien Ahrens, Valentin Lobstein, including a Metasploit module exploits/multi/http/wp_givewp_rce. A Nuclei detection template is also available.

AI-analyzed exploit summary This is a Python-based exploit for CVE-2024-8353, targeting an unauthenticated PHP Object Injection vulnerability in the GiveWP WordPress plugin. It automates the process of retrieving form IDs, nonces, and crafting malicious payloads to achieve remote code execution via deserialization.

Description

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like 'give_title' and 'card_address'. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files and achieve remote code execution. This is essentially the same vulnerability as CVE-2024-5932, however, it was discovered the the presence of stripslashes_deep on user_info allows the is_serialized check to be bypassed. This issue was mostly patched in 3.16.1, but further hardening was added in 3.16.2.

Exploits (3)

nomisec WORKING POC 12 stars
by EQSTLab · remote
https://github.com/EQSTLab/CVE-2024-8353

This is a Python-based exploit for CVE-2024-8353, targeting an unauthenticated PHP Object Injection vulnerability in the GiveWP WordPress plugin. It automates the process of retrieving form IDs, nonces, and crafting malicious payloads to achieve remote code execution via deserialization.

Classification
Working Poc 95%
Attack Type
Deserialization
Complexity
Moderate
Reliability
Reliable
Target: GiveWP (Donation Plugin and Fundraising Platform for WordPress) <= 3.16.1
No auth needed
Prerequisites: Target must have GiveWP plugin installed and vulnerable · Network access to the WordPress site
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 3 stars
by 0xb0mb3r · poc
https://github.com/0xb0mb3r/CVE-2024-8353-PoC

This repository contains a Python script and PHP payload to exploit CVE-2024-8353, an unauthenticated PHP Object Injection vulnerability in the GiveWP WordPress plugin (versions up to 3.16.1). The exploit automates the process of identifying vulnerable forms, retrieving nonces, and delivering payloads to achieve remote code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: GiveWP WordPress plugin <= 3.16.1
No auth needed
Prerequisites: Python 3.x · PHP 7.x or later · Target URL with vulnerable GiveWP plugin
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by Villu Orav, EQSTLab, cuokon, Julien Ahrens, Valentin Lobstein · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_givewp_rce.rb

This Metasploit module exploits a PHP Object Injection vulnerability in GiveWP (CVE-2024-8353) to achieve unauthenticated remote code execution. It bypasses an incomplete patch by leveraging a crafted payload in the donation form processing mechanism.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: GiveWP Donation Plugin and Fundraising Platform for WordPress (versions up to 3.16.1)
No auth needed
Prerequisites: WordPress with vulnerable GiveWP plugin installed · Access to the target's admin-ajax.php endpoint
devstral-2 · analyzed Apr 24, 2026 Full analysis →

Nuclei Templates (1)

GiveWP Donation Plugin <= 3.16.1 - Unauthenticated PHP Object Injection
CRITICALVERIFIEDby hnd3884
Shodan: http.html:"/wp-content/plugins/give/"
FOFA: body="/wp-content/plugins/give/"

Scores

CVSS v3 9.8
EPSS 0.2910
EPSS Percentile 97.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

VulnCheck KEV 2025-03-27
CWE
CWE-502
Status published
Products (2)
givewp/givewp < 3.16.2
stellarwp/GiveWP – Donation Plugin and Fundraising Platform < 3.16.1
Published Sep 28, 2024
Tracked Since Feb 18, 2026