CVE-2024-5932: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injecti

Q: How do I fix CVE-2024-5932?

givewp: upgrade to 3.14.2. Exact commands for each OS are on this page.

Q: Is CVE-2024-5932 being exploited?

CVE-2024-5932 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2024-5932 affect?

CVE-2024-5932 affects givewp. Severity is critical (CVSS 10.0). The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes

Q: How urgent is CVE-2024-5932?

Priority 73/100. Critical severity; EPSS top 1%: very likely to be exploited; Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

This week

CRITICAL 10.0REMOTEUPGRADE

CVE-2024-5932 is a critical-severity flaw (CVSS 10.0) affecting givewp. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.

Why this priority

Critical severity
EPSS top 1%: very likely to be exploited
Public exploit reference
CISA SSVC: automatable with total technical impact
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	10.0 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	76.8% (top 1%)
CISA exploited list	No
Weakness	CWE-502
Published	2024-08-20
Last modified	2026-06-17

Publisher (CNA): Wordfence · Vendor: givewp

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2024-08-20 02:15 UTCPublished CVE record published
2026-06-17 08:16 UTCUpdated Record last modified

givewp givewp UPGRADE

Affected: < 3.14.2

Fixed in: 3.14.2

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy givewp || rpm -q givewp || givewp --version

2. UPGRADE to 3.14.2 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade givewp

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade givewp

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Exact fixes by distribution

Fedora ELN · gram_grep · FIXED · 0.10.4-1.eln159 · FEDORA-2026-0808475f2a · source

sudo dnf upgrade --advisory=FEDORA-2026-0808475f2a

Fedora 46 · wesnoth · FIXED · 1.19.29-1.fc46 · FEDORA-2026-58f458e24e · source

sudo dnf upgrade --advisory=FEDORA-2026-58f458e24e

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

GitHub PoC: EQSTLab/CVE-2024-5932 (77 stars)
GitHub PoC: OxLmahdi/cve-2024-5932 (1 stars)
GitHub PoC: hlc23/CVE-2024-5932-web-ui (0 stars)
Write-up: www.wordfence.com/blog/2024/08/4998-bounty-awarded-and-100000-wordpress-sites-protected-ag
GitHub PoC: 0xb0mb3r/CVE-2024-5932-PoC
Metasploit: GiveWP Unauthenticated Donation Process Exploit
Nuclei scan template: GiveWP - PHP Object Injection

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2024-5932?

givewp: upgrade to 3.14.2. Exact commands for each OS are on this page.

Is CVE-2024-5932 being exploited?

CVE-2024-5932 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2024-5932 affect?

CVE-2024-5932 affects givewp. Severity is critical (CVSS 10.0). The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes

How urgent is CVE-2024-5932?

Priority 73/100. Critical severity; EPSS top 1%: very likely to be exploited; Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

Software pages

WordPress vulnerabilities · PHP vulnerabilities

Related CVEs

CVE-2025-13206 HIGH 7.2 UPGRADE The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site
CVE-2025-11227 MEDIUM 6.5 UPGRADE The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposu
CVE-2025-11228 MEDIUM 5.3 UPGRADE The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modif
CVE-2025-8620 MEDIUM 5.3 UPGRADE The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposu
CVE-2025-7221 MEDIUM 4.3 UPGRADE The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modif

References

← Back to latest CVEs