CVE-2024-9634: GiveWP WordPress Plugin RCE Vulnerability

CVE-2024-9634 Overview

CVE-2024-9634 is a critical PHP Object Injection vulnerability affecting the GiveWP – Donation Plugin and Fundraising Platform for WordPress. The vulnerability exists in all versions up to and including 3.16.3 and allows unauthenticated attackers to inject malicious PHP objects through the give_company_name parameter via deserialization of untrusted input. The presence of a Property-Oriented Programming (POP) chain in the codebase enables attackers to escalate this object injection into full remote code execution on vulnerable WordPress installations.

Critical Impact

Unauthenticated attackers can achieve remote code execution on WordPress sites running vulnerable versions of GiveWP, potentially leading to complete site compromise, data theft, and malware distribution.

Affected Products

• GiveWP Donation Plugin versions up to and including 3.16.3
• WordPress installations with GiveWP plugin installed
• Any website accepting donations through the vulnerable GiveWP functionality

Discovery Timeline

• 2024-10-16 - CVE-2024-9634 published to NVD
• 2025-02-27 - Last updated in NVD database

Technical Details for CVE-2024-9634

Vulnerability Analysis

This vulnerability stems from insecure deserialization practices within the GiveWP plugin's donation processing functionality. When processing donation form submissions, the plugin deserializes user-supplied input from the give_company_name parameter without adequate validation or sanitization. This allows attackers to craft malicious serialized PHP objects that, when deserialized by the server, can trigger unintended code paths.

The vulnerability is particularly severe because the GiveWP plugin contains classes that form a usable POP (Property-Oriented Programming) chain. A POP chain consists of a sequence of class method invocations triggered automatically during deserialization through magic methods such as __wakeup(), __destruct(), or __toString(). By carefully constructing a serialized object that leverages these existing classes, attackers can chain method calls to ultimately achieve arbitrary code execution.

Since no authentication is required to submit donation form data, any remote attacker with network access to a vulnerable WordPress site can exploit this vulnerability. The attack requires no user interaction and can be executed with minimal complexity, making it particularly dangerous for publicly accessible WordPress installations.

Root Cause

The root cause of CVE-2024-9634 is the use of PHP's unserialize() function on untrusted user input without implementing proper input validation or using safe deserialization alternatives. The give_company_name parameter in the donation processing workflow accepts serialized data that is directly passed to deserialization functions. Combined with the presence of exploitable gadget classes within the plugin's codebase or commonly installed dependencies, this creates a complete exploit chain from user input to code execution.

Attack Vector

The attack is network-based and targets the donation form submission endpoint. An attacker crafts a malicious HTTP request containing a specially serialized PHP object in the give_company_name form field. When the GiveWP plugin processes this donation request, it deserializes the attacker-controlled data, instantiating the malicious object. The POP chain within the codebase is then triggered, executing arbitrary PHP code with the privileges of the web server process.

The vulnerability exists in the DonationRepository.php file within the donation processing logic. For detailed technical information about the vulnerable code path, refer to the WordPress Plugin Code Repository.

Detection Methods for CVE-2024-9634

Indicators of Compromise

• Unexpected serialized PHP object patterns in web server access logs, particularly in POST requests to donation endpoints
• Unusual process spawning from the web server process (e.g., www-data or apache user)
• New or modified files in WordPress directories, especially in plugin folders or upload directories
• Suspicious entries in WordPress options table or postmeta containing serialized data
• Outbound network connections from the web server to unknown external hosts

Detection Strategies

• Monitor HTTP POST requests to GiveWP donation endpoints for serialized PHP object patterns (strings beginning with O: or a: followed by numeric values)
• Implement Web Application Firewall (WAF) rules to detect and block PHP serialized object patterns in form submissions
• Review PHP error logs for deserialization-related errors or unexpected class instantiation warnings
• Deploy endpoint detection solutions capable of identifying suspicious PHP process behavior
• Utilize SentinelOne's behavioral AI to detect post-exploitation activities such as webshell deployment or lateral movement

Monitoring Recommendations

• Enable verbose logging on WordPress donation form submissions and review for anomalous company name field values
• Configure alerts for any file modifications in the GiveWP plugin directory outside of legitimate update windows
• Monitor outbound network traffic from web servers for indicators of command-and-control communication
• Implement integrity monitoring on critical WordPress files and plugin directories

How to Mitigate CVE-2024-9634

Immediate Actions Required

• Update GiveWP plugin to version 3.16.4 or later immediately
• Review web server logs for signs of exploitation attempts targeting the give_company_name parameter
• Conduct a security audit of WordPress installations to identify any indicators of compromise
• Consider temporarily disabling the GiveWP donation form functionality until patching is complete
• Implement WAF rules to block serialized PHP object patterns in form submissions as an interim measure

Patch Information

The GiveWP development team has released version 3.16.4 which addresses this vulnerability. The patch modifies the donation processing logic in process-donation.php to properly validate and sanitize input before deserialization. Site administrators should update immediately through the WordPress admin dashboard or by downloading the patched version from the WordPress plugin repository.

For technical details on the fix implementation, refer to the WordPress Plugin Changeset Update.

Additional vulnerability intelligence is available from the Wordfence Vulnerability Report.

Workarounds

• Deploy a Web Application Firewall with rules to block requests containing serialized PHP objects in form parameters
• Implement server-level input filtering to strip or reject serialized object patterns in POST data
• Restrict access to donation form endpoints to authenticated users only if business requirements permit
• Use PHP runtime protections such as disable_functions to limit potentially dangerous functions that could be leveraged in POP chains

# Example WAF rule for ModSecurity to block PHP serialized objects
SecRule ARGS "@rx O:\d+:\"[a-zA-Z_]" \
    "id:100001,\
    phase:2,\
    deny,\
    status:403,\
    msg:'Potential PHP Object Injection Attack',\
    logdata:'Matched Data: %{MATCHED_VAR}'"