CVE-2025-0912

Published Mar 4, 2025

Last updated 12 days ago

WordPress

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-0912 is a critical vulnerability affecting the GiveWP WordPress donation plugin, specifically versions 3.19.4 and earlier. It stems from improper sanitization of the `card_address` parameter in donation forms, allowing unauthenticated attackers to inject malicious PHP objects. This vulnerability enables remote code execution (RCE) attacks. Exploiting this flaw involves leveraging a property-oriented programming (POP) chain within the plugin's code. This allows attackers to escalate the object injection vulnerability into full server compromise. Consequences can include arbitrary file deletion, database credential leaks, and backdoor installation via web shells. A patch is available in version 3.20.0 of the GiveWP plugin, which implements stricter input validation and removes the unsafe deserialization logic.

Description: The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserialization of untrusted input from the Donation Form through the 'card_address' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution.
Source: security@wordfence.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security@wordfence.com: CWE-502
nvd@nist.gov: CWE-502

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:givewp:givewp:*:*:*:*:*:wordpress:*:*",
            "vulnerable": true,
            "matchCriteriaId": "04645A10-A7FC-4550-9321-6F01E2FBF448",
            "versionEndExcluding": "3.20.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]