CVE-2026-19658: WordPress Give Tributes Plugin RCE Vulnerability

CVE-2026-19658 Overview

CVE-2026-19658 is a PHP Object Injection vulnerability in the Give Tributes plugin for WordPress. The flaw affects all versions up to and including 2.3.1 and stems from deserialization of untrusted input [CWE-502]. Unauthenticated attackers can inject arbitrary PHP objects through the donation form when the Allow Multiple Recipients option is enabled and the eCard Custom Message option is disabled.

The plugin itself does not ship a Property-Oriented Programming (POP) chain. Exploitation impact therefore depends on other plugins or themes installed on the target site. When a suitable POP chain exists in the environment, attackers may delete arbitrary files, exfiltrate sensitive data, or execute code.

Critical Impact

Unauthenticated attackers can inject PHP objects into vulnerable WordPress sites, potentially leading to arbitrary file deletion, sensitive data disclosure, or remote code execution when a POP chain is available.

Affected Products

• Give Tributes plugin for WordPress, all versions through 2.3.1
• WordPress sites running Give Tributes with Allow Multiple Recipients enabled
• WordPress sites with additional plugins or themes that expose a POP chain

Discovery Timeline

• 2026-09-22 - CVE-2026-19658 published to the National Vulnerability Database
• 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-19658

Vulnerability Analysis

The Give Tributes plugin passes attacker-controlled input to a PHP deserialization function without validating that the data is safe. When PHP encounters a serialized object during unserialize(), it instantiates the described class and invokes lifecycle magic methods such as __wakeup() and __destruct(). An attacker who supplies a crafted serialized payload can therefore trigger method calls on classes already loaded in the WordPress runtime.

Because the Give Tributes plugin does not itself define a usable POP chain, direct exploitation of the plugin alone has no security impact. Real-world WordPress installations, however, commonly load dozens of plugins and themes. Any one of them can introduce classes with dangerous __destruct() or __wakeup() behavior, which the injected object then chains into arbitrary file operations or code execution.

Exploitation requires two site configuration preconditions: the donation form must have Allow Multiple Recipients enabled, and the eCard Custom Message option must be disabled. The single-recipient path applies sanitize_textarea_field(), which neutralizes serialized payloads. When Custom Message is enabled, GiveWP's give_clean() blanks serialized input during validation, rejecting the donation.

Root Cause

The root cause is untrusted deserialization [CWE-502] in the multi-recipient donation processing path. Input intended for donation metadata is passed to unserialize() without type checking or allow-listing of expected classes.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker submits a crafted donation request containing a serialized PHP object payload in the multi-recipient field. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-19658

Indicators of Compromise

• HTTP POST requests to donation form endpoints containing serialized PHP markers such as O:, a:, or s: in multi-recipient parameters.
• Unexpected file deletions, new PHP files, or modified plugin/theme files following donation form activity.
• Web server error logs referencing unserialize() warnings or unexpected class instantiations tied to installed plugins or themes.
• Outbound network connections from the WordPress host initiated by the PHP-FPM or web server process after donation submissions.

Detection Strategies

• Inspect web application firewall (WAF) logs for serialized PHP object patterns in requests targeting Give Tributes endpoints.
• Enumerate WordPress installations to identify sites running Give Tributes 2.3.1 or earlier with Allow Multiple Recipients enabled.
• Correlate donation submissions with subsequent filesystem or process anomalies on the host.

Monitoring Recommendations

• Monitor changes to wp-content/plugins, wp-content/themes, and wp-content/uploads directories.
• Alert on PHP processes spawning shells, curl, wget, or other network utilities.
• Track database writes to donation-related tables that contain serialized PHP tokens.

How to Mitigate CVE-2026-19658

Immediate Actions Required

• Update the Give Tributes plugin to a version later than 2.3.1 as soon as the vendor releases a fix.
• Disable the Give Tributes plugin if a patched version is not yet available and donations rely on multiple recipients.
• Audit installed plugins and themes for known POP chains and remove unused components.
• Enable the eCard Custom Message option or disable Allow Multiple Recipients to close the reachable code path.

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry. Monitor the Liquid Web Software Offering page and the Wordfence Vulnerability Report for updated version guidance.

Workarounds

• Turn off Allow Multiple Recipients in every donation form until a patched version is installed.
• Enable the eCard Custom Message option so give_clean() blanks serialized payloads during validation.
• Deploy WAF rules that block serialized PHP object patterns in requests to donation endpoints.
• Restrict filesystem write permissions for the web server user to limit POP chain impact.

# Example WAF rule pattern to block serialized PHP objects in donation requests
# ModSecurity-style rule (illustrative)
SecRule ARGS "@rx (?:^|[&=])(?:O|a|s):[0-9]+:\"" \
    "id:1026196580,phase:2,deny,status:403,\
    msg:'Possible PHP Object Injection payload - CVE-2026-19658',\
    tag:'CWE-502'"