Description

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from n/a through 4.16.7.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-28T12:16:32.810Z",
  "pubdate": "2026-08-28T12:16:32.810Z",
  "executiveSummary": "The GiveWP plugin for WordPress, developed by Liquid Web / StellarWP, contains a Deserialization of Untrusted Data vulnerability. This flaw enables unauthenticated or low-privileged remote attackers to perform PHP Object Injection.\nBy supplying maliciously crafted serialized data to the application, an attacker can manipulate object properties within the plugin's execution context. Successful exploitation can lead to severe security compromises, including unauthorized file deletion, arbitrary code execution (ACE), or privilege escalation, depending on the availability of suitable 'gadget chains' present in the environment.\nThe vulnerability affects all versions of GiveWP from n/a through 4.16.7.1. Because this vulnerability targets the fundamental way the application handles serialized input, it poses a critical risk to site integrity and confidentiality.\nRemediation requires immediate attention from administrators to secure the application against unauthorized object instantiation.",
  "technicalDetails": "The vulnerability stems from the improper handling of untrusted user-supplied data during the deserialization process. In PHP, the unserialize() function is used to convert a stored or transmitted string representation of a variable back into a PHP value. When this function processes input that is not sufficiently sanitized or validated, it allows the reconstruction of objects.\nThe core issue is that the application trusts incoming serialized strings, which an attacker can manipulate to instantiate objects of arbitrary classes currently defined within the application's scope (including those from WordPress core, other plugins, or the theme).\nExploitation involves the creation of a 'gadget chain.' A gadget chain is a sequence of existing code methods ('gadgets') found within the application that, when triggered during or after the object's destruction or wakeup (via magic methods like __wakeup(), __destruct(), or __toString()), performs unintended actions.\nAttack Flow: 1. Identification: The attacker identifies an entry point within the GiveWP plugin that accepts serialized data as user input (e.g., via GET/POST parameters or cookie data). 2. Payload Crafting: The attacker crafts a serialized PHP string containing properties that correspond to a specific gadget chain available in the environment. 3. Injection: The attacker transmits the payload to the vulnerable endpoint. 4. Deserialization: The application calls unserialize() on the malicious input. 5. Execution: PHP instantiates the specified class and, upon the script's completion or the object's destruction, the magic methods are triggered, leading to the execution of the attacker's chosen code path.\nImpact: Because the injection occurs within the server-side process, the attacker can leverage the application's permissions. This may result in Remote Code Execution (RCE) if a viable gadget chain is present, or local file read/write operations. Given that this affects the plugin ecosystem, the potential for cross-plugin gadget chain interaction is significant. There are no authentication requirements mentioned for the trigger, making this a highly dangerous vulnerability."
}