Description

The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This vulnerability is only reachable when the "Allow Multiple Recipients" option is enabled for the donation form, as the single-recipient code path applies sanitize_textarea_field() which would neutralize the payload. Exploitation additionally requires the eCard "Custom Message" option to be disabled, which is the plugin default: when it is enabled the personalized message becomes a required field and GiveWP's give_clean() blanks serialized input during validation, causing the donation to be rejected before it is stored.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-22T05:16:55.167Z",
  "pubdate": "2026-09-22T05:16:55.167Z",
  "executiveSummary": "The Give Tributes WordPress plugin, in versions up to and including 2.3.1, contains a critical PHP Object Injection vulnerability. This flaw arises from the improper deserialization of untrusted user input during the donation process.\nUnauthenticated attackers can inject arbitrary PHP objects into the application scope. While the plugin itself does not contain a Property Oriented Programming (POP) chain, the vulnerability creates a severe security risk when co-located with other plugins or themes that do contain exploitable POP chains.\nSuccessful exploitation requires specific plugin configurations: the 'Allow Multiple Recipients' option must be enabled, and the 'Custom Message' eCard option must be disabled. When these conditions are met, an attacker can leverage the injection to execute malicious actions, such as arbitrary file deletion, sensitive data exfiltration, or remote code execution, depending entirely on the secondary components present in the environment.\nThis vulnerability is classified as high-risk due to the potential for full site compromise if a compatible gadget chain exists within the WordPress installation ecosystem.",
  "technicalDetails": "The root cause of this vulnerability is the insecure use of the PHP unserialize() function on user-supplied data within the Give Tributes plugin. By passing serialized input through the donation form submission process, the plugin fails to validate or sanitize the structure of the data before reconstructing the object.\nThe vulnerability is reachable under specific configuration constraints. The application flow bypasses safer code paths—specifically those utilizing sanitize_textarea_field()—only when the 'Allow Multiple Recipients' setting is active. If this setting is disabled, the input is neutralized, preventing the injection. Furthermore, the 'Custom Message' eCard option must be disabled; if enabled, the give_clean() function performs validation that strips serialized strings, causing the request to fail before the object can be instantiated.\nThe attack flow proceeds as follows: An unauthenticated attacker crafts a serialized PHP object payload designed to interact with known gadget chains (POP chains) present in the target environment (e.g., classes defined in other installed plugins or the active theme). The attacker submits this payload via the donation form field targeted by the vulnerable deserialization logic. Upon submission, the plugin unserializes the input, effectively injecting the object into the memory space of the application.\nOnce the object is successfully injected, the PHP runtime triggers magic methods—such as __wakeup() or __destruct()—within the injected class. If these methods interact with properties in a way that aligns with an existing POP chain, the attacker can hijack the application logic. Post-exploitation impact is entirely contingent upon the availability and utility of these gadgets. If an attacker identifies a gadget capable of file operations, they may be able to achieve arbitrary file deletion or unauthorized configuration changes. If a gadget facilitates reflection or object manipulation, sensitive data retrieval or remote code execution may become possible.\nBecause the vulnerability requires the presence of a secondary gadget chain, it is classified as a situational deserialization flaw. It remains unauthenticated and remotely exploitable, requiring no specific privileges on the WordPress site. The vulnerability affects all versions up to 2.3.1 and exists within the donation processing component of the Give Tributes plugin."
}