Friend
Professional
- Messages
- 2,653
- Reaction score
- 851
- Points
- 113
The identified RCE vulnerability received the highest CVSS score.
A critical vulnerability has been discovered in a popular WordPress plugin called GiveWP, which is used to collect donations and conduct fundraising campaigns. It compromises the security of more than 100,000 sites, opening up the possibility of remote code execution.
With a maximum CVSS score of 10, CVE-2024-5932 affects all versions of the plugin up to version 3.14.2, released on August 7, 2024. The problem was reported by a security researcher known by the pseudonym villu164.
According to Wordfence, the GiveWP plugin is vulnerable to a PHP Object Injection attack via the "give_title" parameter. This vulnerability allows unauthorized attackers to inject a PHP object, which, in combination with the POP chain, allows remote code execution and deletion of arbitrary files on the server.
The root of the problem is in the "give_process_donation_form()" function, which is responsible for verifying and cleaning the data entered into the donation form before transferring it to the payment gateway. Successful exploitation of this vulnerability could allow attackers to run malicious code on the server, making it imperative to update the plugin to the latest version.
The news comes on the heels of another recently discovered critical vulnerability in the InPost PL and InPost plugins for WooCommerce (CVE-2024-6500), which has also received the highest CVSS score and allows remote reading and deletion of arbitrary files, including wp-config.php. On Linux systems, only files inside the WordPress directory can be deleted, but attackers can read absolutely any file. The problem has been fixed in plugin version 1.4.5.
Another serious vulnerability was identified by a Wordfence researcher in the JS Help Desk plugin, which is installed on more than 5 thousand sites. It received the code CVE-2024-7094 with a score of 9.8 and allows you to execute remote code through PHP injection. The fix was released in version 2.8.7.
Experts strongly recommend updating all vulnerable plugins to the latest versions to prevent possible attacks. In particular, the vulnerabilities can be used to inject skimmers that steal financial information entered by site visitors.
The researchers also warn WordPress site owners against using unlicensed plugins and themes, as they can be a source of malware and other security threats. Ultimately, the use of legitimate software is the foundation of responsible website management. Compromises in security for the sake of short-term benefits are absolutely unacceptable.
Source
A critical vulnerability has been discovered in a popular WordPress plugin called GiveWP, which is used to collect donations and conduct fundraising campaigns. It compromises the security of more than 100,000 sites, opening up the possibility of remote code execution.
With a maximum CVSS score of 10, CVE-2024-5932 affects all versions of the plugin up to version 3.14.2, released on August 7, 2024. The problem was reported by a security researcher known by the pseudonym villu164.
According to Wordfence, the GiveWP plugin is vulnerable to a PHP Object Injection attack via the "give_title" parameter. This vulnerability allows unauthorized attackers to inject a PHP object, which, in combination with the POP chain, allows remote code execution and deletion of arbitrary files on the server.
The root of the problem is in the "give_process_donation_form()" function, which is responsible for verifying and cleaning the data entered into the donation form before transferring it to the payment gateway. Successful exploitation of this vulnerability could allow attackers to run malicious code on the server, making it imperative to update the plugin to the latest version.
The news comes on the heels of another recently discovered critical vulnerability in the InPost PL and InPost plugins for WooCommerce (CVE-2024-6500), which has also received the highest CVSS score and allows remote reading and deletion of arbitrary files, including wp-config.php. On Linux systems, only files inside the WordPress directory can be deleted, but attackers can read absolutely any file. The problem has been fixed in plugin version 1.4.5.
Another serious vulnerability was identified by a Wordfence researcher in the JS Help Desk plugin, which is installed on more than 5 thousand sites. It received the code CVE-2024-7094 with a score of 9.8 and allows you to execute remote code through PHP injection. The fix was released in version 2.8.7.
Experts strongly recommend updating all vulnerable plugins to the latest versions to prevent possible attacks. In particular, the vulnerabilities can be used to inject skimmers that steal financial information entered by site visitors.
The researchers also warn WordPress site owners against using unlicensed plugins and themes, as they can be a source of malware and other security threats. Ultimately, the use of legitimate software is the foundation of responsible website management. Compromises in security for the sake of short-term benefits are absolutely unacceptable.
Source
