CVE-2025-22777: GiveWP Object Injection Vulnerability

CVE-2025-22777 Overview

CVE-2025-22777 is a PHP Object Injection vulnerability affecting the StellarWP GiveWP donation plugin for WordPress. The flaw stems from insecure deserialization of untrusted data [CWE-502] and impacts all versions up to and including 3.19.3. With over 100,000 active installations, GiveWP represents a significant attack surface for WordPress sites processing donations. Unauthenticated attackers can exploit this vulnerability over the network without user interaction to inject arbitrary PHP objects. Successful exploitation can lead to remote code execution, data tampering, and complete site compromise when a suitable POP (Property-Oriented Programming) chain is present.

Critical Impact

Unauthenticated attackers can trigger PHP object injection over the network, potentially achieving remote code execution on WordPress sites running GiveWP versions through 3.19.3.

Affected Products

• StellarWP GiveWP plugin for WordPress (versions through 3.19.3)
• WordPress sites with GiveWP donation forms enabled
• All deployments using the givewp:givewp component

Discovery Timeline

• 2025-01-13 - CVE-2025-22777 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-22777

Vulnerability Analysis

The vulnerability resides in how GiveWP processes serialized PHP data received from untrusted sources. The plugin passes attacker-controlled input to PHP's unserialize() function without sufficient validation. This allows arbitrary PHP objects to be instantiated within the application context. When combined with classes that define magic methods such as __wakeup(), __destruct(), or __toString(), attackers can chain operations to achieve code execution, file operations, or data exfiltration.

The issue affects donation processing workflows reachable by unauthenticated users. No authentication or user interaction is required to deliver the malicious payload. Refer to the Patchstack Vulnerability Report for the full technical breakdown.

Root Cause

The root cause is the use of unserialize() on data that originates from user-supplied input without integrity validation. PHP's serialization format permits instantiation of any class loaded in the application. WordPress and its plugins expose numerous classes that can be abused as gadgets in a POP chain. GiveWP did not restrict allowed classes or apply cryptographic signatures to serialized payloads.

Attack Vector

An attacker crafts a serialized PHP object containing a gadget chain assembled from classes available in WordPress core, GiveWP, or other installed plugins. The attacker submits this payload through a vulnerable donation parameter that reaches the unsafe deserialization sink. Upon deserialization, the magic methods execute the gadget chain, which can trigger file writes, SQL queries, or arbitrary function calls. Additional analysis is available in the Security Online CVE Analysis.

Detection Methods for CVE-2025-22777

Indicators of Compromise

• HTTP POST requests to GiveWP donation endpoints containing serialized PHP patterns such as O:, a:, or s: followed by class names and lengths
• Unexpected PHP files created under wp-content/uploads/ or plugin directories after donation form submissions
• New or modified WordPress administrator accounts created without corresponding admin activity
• Outbound network connections from the web server to unknown hosts following donation traffic

Detection Strategies

• Inspect web server and application logs for serialized object signatures in request bodies and query strings targeting /wp-admin/admin-ajax.php or GiveWP REST endpoints
• Deploy web application firewall rules that flag PHP serialization patterns in donation form parameters
• Compare installed GiveWP plugin version against the patched release using wp plugin list --name=give on managed hosts
• Monitor PHP error logs for __wakeup or __destruct exceptions that may indicate failed exploitation attempts

Monitoring Recommendations

• Enable file integrity monitoring on the wp-content/plugins/give/ directory and the WordPress root
• Alert on creation of PHP files in upload directories where executable content should not exist
• Track HTTP request payload sizes for GiveWP endpoints to identify anomalously large submissions
• Correlate authentication anomalies with donation traffic spikes for early identification of post-exploitation activity

How to Mitigate CVE-2025-22777

Immediate Actions Required

• Update GiveWP to a version later than 3.19.3 as soon as the patched release is applied across all WordPress instances
• Audit the site for unauthorized administrator accounts, modified files, and unexpected scheduled tasks (wp_cron)
• Temporarily disable the GiveWP plugin on sites that cannot be patched immediately
• Review web server logs covering the period before the patch for serialized payloads indicating prior exploitation

Patch Information

StellarWP has addressed the vulnerability in releases following version 3.19.3. Site operators should consult the Patchstack Vulnerability Report for the specific fixed version and apply the update through the WordPress plugin manager or WP-CLI.

Workarounds

• Place a web application firewall in front of WordPress and block requests containing PHP serialization markers in donation parameters
• Restrict access to GiveWP endpoints by IP address where feasible until patching is complete
• Disable the GiveWP plugin entirely if donation functionality is not currently required

# Update GiveWP using WP-CLI on the affected host
wp plugin update give --version=latest
wp plugin list --name=give --fields=name,version,status