GiveWP Vulnerability – Donation Plugin and Fundraising Platform – Authenticated PHP Object Injection – CVE-2024-30229 | WordPress Plugin Vulnerability Report 

Plugin Name: GiveWP – Donation Plugin and Fundraising Platform

Key Information:

  • Software Type: Plugin
  • Software Slug: give
  • Software Status: Active
  • Software Author: webdevmattcrom
  • Software Downloads: 7,225,697
  • Active Installs: 100,000
  • Last Updated: May 13, 2024
  • Patched Versions: 3.5.0
  • Affected Versions: <= 3.4.2

Vulnerability Details:

  • Name: GiveWP – Donation Plugin and Fundraising Platform <= 3.4.2
  • Title: Authenticated (GiveWP Manager+) PHP Object Injection
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE: CVE-2024-30229
  • CVSS Score: 8.8
  • Publicly Published: April 26, 2024
  • Researcher: Rafie Muhammad - Patchstack
  • Description: The GiveWP plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.2 via deserialization of untrusted input. This vulnerability allows authenticated attackers, with give manager-level access and above, to inject a PHP object. Although no known POP chain is currently present in the plugin itself, if an additional plugin or theme installed on the same system contains a POP chain, it could allow the attacker to execute arbitrary code, delete files, or access sensitive data.


The GiveWP – Donation Plugin and Fundraising Platform for WordPress has a vulnerability in versions up to and including 3.4.2 that exposes it to PHP object injection by authenticated users with manager-level access. This critical security flaw has been addressed in version 3.5.0.

Detailed Overview:

Discovered by Rafie Muhammad of Patchstack, this significant vulnerability in the GiveWP plugin arises from the improper handling of serialized data. The flaw enables attackers with the necessary permissions to inject malicious PHP objects into the stream, potentially leading to severe consequences like code execution, data theft, or file deletion if they can exploit a POP chain present in other components of the WordPress installation. The developers have fixed this vulnerability in the latest release, version 3.5.0, which implements stricter input validation to prevent such attacks.

Advice for Users:

  • Immediate Action: Update to version 3.5.0 immediately to mitigate this security issue.
  • Check for Signs of Vulnerability: Monitor your website logs and user roles to ensure no unauthorized activities have occurred.
  • Alternate Plugins: Consider using alternative donation and fundraising plugins if you prefer a different security approach or feature set.
  • Stay Updated: Regularly update your WordPress installation, themes, and plugins to the latest versions to protect against known vulnerabilities.

Conclusion: The swift action taken by the developers of the GiveWP plugin to correct this PHP Object Injection vulnerability illustrates the critical role that ongoing maintenance and updates play in securing web applications. As this incident shows, even authenticated and seemingly secure systems can be compromised without diligent attention to security updates. Users are advised to install version 3.5.0 or later to protect their WordPress sites from potential threats.


Detailed Report: 

In the digital age, the security of your website is as crucial as the physical security of your business premises. Recently, a significant vulnerability was identified in the GiveWP – Donation Plugin and Fundraising Platform, one of the most popular WordPress plugins, which has been downloaded over 7 million times. This vulnerability, specifically an Authenticated PHP Object Injection (CVE-2024-30229), poses a serious risk to sites using versions up to and including 3.4.2. Authenticated users with manager-level access could exploit this flaw to execute arbitrary code, delete files, or steal sensitive data if certain conditions are met. This breach not only underscores the vulnerabilities that can exist even in widely trusted plugins but also highlights the necessity of regular updates and vigilance in maintaining website security. For website owners who might feel overwhelmed by the technicalities of such issues, this post aims to demystify the steps needed to safeguard your platform, ensuring that your charitable contributions and interactions remain secure and trustworthy.

Risks and Potential Impacts:

The ability for attackers to execute code or manipulate data through the GiveWP plugin is particularly alarming due to the nature of the data typically handled by this plugin—donations and personal donor information. Such breaches could lead to significant financial loss, erosion of donor trust, and severe reputational damage.

Remediation Steps:

  • Immediate Update: Users should update immediately to the latest patched version, 3.5.0, which fixes the vulnerability by implementing stricter input validation.
  • Check for Anomalies: Review your site's logs and settings to detect any signs of compromise or unusual activities.
  • Regular Monitoring: Set up continuous monitoring or use security services to get alerts for suspicious activities on your site.

Previous Vulnerabilities:

This is not the first time vulnerabilities have been discovered in the GiveWP plugin. Since its launch, there have been 40 recorded vulnerabilities, highlighting the ongoing need for vigilance and regular updates.


The discovery and swift correction of the PHP Object Injection vulnerability in the GiveWP plugin illustrate the ongoing battle against cyber threats in the world of WordPress plugins. For small business owners, the key takeaway should be the importance of maintaining up-to-date systems and employing robust security measures. Given the complexities of modern cybersecurity threats, enlisting professional help or utilizing managed WordPress hosting services that include security updates can be a sensible investment, ensuring that your charitable engagement and donor interactions remain uncompromised.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

GiveWP Vulnerability – Donation Plugin and Fundraising Platform – Authenticated PHP Object Injection – CVE-2024-30229 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment