CVE-2024-12877: GiveWP WordPress Plugin RCE Vulnerability

CVE-2024-12877 Overview

CVE-2024-12877 is a PHP Object Injection vulnerability affecting the GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress. This popular fundraising and donation plugin contains a critical flaw in how it processes user input from donation forms, specifically the firstName field and similar inputs. The vulnerability allows unauthenticated attackers to inject malicious PHP objects through deserialization of untrusted input.

The presence of a POP (Property-Oriented Programming) chain within the plugin's codebase significantly escalates the impact, enabling attackers to delete arbitrary files on the server. This file deletion capability can be leveraged to achieve remote code execution, making this vulnerability particularly severe for WordPress sites utilizing GiveWP for donation processing.

Critical Impact

Unauthenticated attackers can exploit this vulnerability to achieve remote code execution on WordPress servers by injecting malicious PHP objects through donation form fields, potentially compromising entire websites and donor data.

Affected Products

• GiveWP Plugin for WordPress versions up to and including 3.19.2
• GiveWP Plugin version 3.19.3 (partially patched)
• WordPress installations running vulnerable GiveWP versions

Discovery Timeline

• 2025-01-11 - CVE CVE-2024-12877 published to NVD
• 2025-02-25 - Last updated in NVD database

Technical Details for CVE-2024-12877

Vulnerability Analysis

This vulnerability stems from insecure deserialization practices within the GiveWP plugin. When processing donation form submissions, the plugin deserializes user-supplied input without proper validation or sanitization. This is classified as CWE-502 (Deserialization of Untrusted Data), a well-documented vulnerability class that has led to numerous high-profile security incidents.

The attack surface is particularly concerning because donation forms are inherently public-facing features designed to accept input from unauthenticated users. Any visitor to a WordPress site using GiveWP can submit donation form data, providing a readily available entry point for exploitation.

What elevates this vulnerability from a theoretical concern to a practical threat is the existence of a POP chain within the plugin or WordPress ecosystem. POP chains are sequences of existing code (gadgets) that can be chained together during deserialization to perform malicious actions. In this case, the chain enables arbitrary file deletion, which attackers can weaponize to achieve code execution by deleting critical protection files like .htaccess or wp-config.php.

Root Cause

The root cause lies in the plugin's use of PHP's native deserialization functions (unserialize()) on user-controlled data from donation form fields. The firstName parameter and other form inputs are processed without being properly sanitized or restricted to safe data types. The vendor has been advised to implement JSON encoding instead of PHP serialization to prevent further deserialization vulnerabilities, as JSON deserialization does not instantiate objects and is therefore immune to object injection attacks.

Attack Vector

The attack is network-based and requires no authentication or user interaction, making it highly accessible to remote attackers. An attacker can craft a malicious serialized PHP object payload and submit it through the donation form's input fields. When the server processes this input:

1. The malicious serialized data is passed to PHP's unserialize() function
2. PHP instantiates the attacker-controlled object with specially crafted properties
3. The POP chain triggers during object destruction or method invocation
4. Arbitrary files are deleted from the server filesystem
5. The attacker leverages file deletion to achieve remote code execution

The vulnerability requires no special privileges or prior access to the target system. The attack can be executed by simply submitting a specially crafted donation form, making mass exploitation feasible.

Detection Methods for CVE-2024-12877

Indicators of Compromise

• Unexpected or suspicious donation form submissions containing serialized PHP data patterns (e.g., O:8:"ClassName" format)
• Missing critical WordPress files such as wp-config.php, .htaccess, or plugin files
• Unusual file system activity or file deletion events in server logs
• Web server logs showing POST requests to donation endpoints with abnormally long or encoded payloads

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block serialized PHP object patterns in HTTP request bodies
• Monitor WordPress error logs for deserialization-related warnings or class instantiation errors
• Deploy file integrity monitoring solutions to detect unauthorized file deletions or modifications
• Enable detailed logging for the GiveWP plugin and review for anomalous form submission patterns

Monitoring Recommendations

• Configure real-time alerts for changes to critical WordPress configuration files
• Monitor outbound network connections from the WordPress server for potential callback attempts
• Implement SentinelOne's WordPress runtime protection to detect and block malicious object instantiation attempts
• Regularly audit donation submission logs for suspicious patterns or payloads

How to Mitigate CVE-2024-12877

Immediate Actions Required

• Update GiveWP to version 3.19.4 or later immediately, as versions through 3.19.3 remain only partially patched
• If immediate updates are not possible, disable the GiveWP plugin temporarily until patching can be performed
• Audit WordPress installations to identify all instances of GiveWP and prioritize updates based on exposure
• Review server logs and file system integrity to identify potential prior exploitation

Patch Information

The vendor released patches addressing this vulnerability in version 3.19.3, though that release only provided a partial fix. A complete remediation was made available in version 3.19.4. Organizations should update to 3.19.4 or the latest available version to ensure full protection. Technical details of the patch can be reviewed in the WordPress Changeset Update.

For additional vulnerability analysis and context, refer to the Wordfence Vulnerability Analysis.

Workarounds

• Implement a WAF rule to block HTTP requests containing PHP serialization patterns in donation form fields
• Restrict access to donation forms using IP allowlisting or CAPTCHA protection to reduce attack surface
• Configure PHP settings to disable potentially dangerous classes that may be leveraged in POP chains (if operationally feasible)

# Example WAF rule for ModSecurity to block serialized PHP objects
SecRule REQUEST_BODY "@rx [OoNncCrR]:\d+:" "id:1001,phase:2,deny,status:403,msg:'PHP Object Injection Attempt'"