Loading story…
A critical vulnerability in the GiveWP WordPress donation plugin exposed more than 100,000 websites to unauthenticated remote code execution and arbitrary file deletion. The flaw, tracked as CVE-2024-5932 and rated CVSS 10.0, affects GiveWP 3.14.1 and earlier. Researchers said the bug stems from improper validation and sanitization of the give_title parameter in the give_process_donation_form() function, enabling PHP object injection through unsafe deserialization.
Successful exploitation could allow attackers to delete files such as wpconfig.php, disclose sensitive information, and potentially take full control of a vulnerable WordPress instance. Wordfence reported a bounty award tied to the discovery and said protections were deployed for its users, while CSIRT.SK urged administrators to update immediately to GiveWP 3.14.2 or later to block exploitation.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A critical vulnerability in the GiveWP WordPress plugin, tracked as CVE-2024-5932, was addressed in GiveWP version 3.14.2. The flaw affected version 3.14.1 and earlier and could enable unauthenticated remote code execution and arbitrary file deletion via PHP object injection.
On 2024-08-23, CSIRT.SK published an alert describing CVE-2024-5932 as a critical GiveWP vulnerability with a CVSS score of 10.0. The advisory said exploitation could lead to arbitrary file deletion, leakage of sensitive information, and possible full compromise of a vulnerable WordPress site, and urged updating to version 3.14.2 or later.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2026-82222** is a CVSS 10.0 remote-code-execution flaw in the Liquid Web/StellarWP GiveWP WordPress donation plugin affecting versions through `4.16.7.1`. Unsafe PHP deserialization can be combined with attacker-controlled donation-session metadata and a gadget chain in bundled TCPDF and GiveWP TestData components to invoke arbitrary server commands. Default installations with a public donation form and active payment gateway are exposed in versions `4.16.5.1` and earlier; later affected versions require specific legacy-form conditions. GiveWP released `4.16.7.2` to block serialized donation data, restrict deserialization paths, validate gadget-related data, sanitize metadata, and remove previously stored serialized payloads from databases. Administrators should update immediately and review systems for suspicious donation-session records or unexpected server-side command execution. A separate registration-action access-control weakness can still create WordPress accounts while registration is disabled, but it no longer provides an RCE path after the deserialization fix.
Aug 31, 2026
Multiple **WordPress plugins** were flagged for severe vulnerabilities that could let attackers take over sites through unauthenticated file upload, SQL injection, arbitrary file deletion, and authorization bypass. References point to issues in plugins including **WP Duplicate**, **Ninja Forms File Upload**, **Ultimate Member**, **Product Addons for WooCommerce**, **CleanTalk Spam Protect**, **Ally**, **Perfmatters**, and **Kali Forms**, alongside identifiers such as **`CVE-2024-48930`**, **`CVE-2025-13192`**, and **`CVE-2026-1104`**. Several flaws were described as allowing arbitrary plugin installation, malicious file upload, or direct database manipulation, creating a path to remote code execution and full site compromise. Wordfence reports indicate the exposure spans **hundreds of thousands of WordPress sites**, with some bugs already under **active exploitation**. The most serious cases include an unauthenticated SQL injection flaw in the **Ally** plugin affecting roughly **400,000 sites**, an arbitrary file deletion issue in **Perfmatters** affecting about **200,000 sites**, and active attacks targeting a critical flaw in **Kali Forms**. Taken together, the disclosures show a broad wave of high-impact plugin security failures that increase the risk of website defacement, malware deployment, data theft, and administrator-level compromise across the WordPress ecosystem.
Jul 12, 2026
Two high-severity vulnerabilities have been disclosed in widely deployed WordPress plugins, exposing internet-facing sites to **unauthenticated compromise**. `CVE-2026-3584` affects **Kali Forms** through version `2.4.9` and allows **remote code execution** because user-controlled input can be mapped into internal placeholder storage and later invoked via `call_user_func` in the `form_process` path. The issue is classified as `CWE-94` and carries a `CVSS 3.1` score with the vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating critical impact on confidentiality, integrity, and availability. A second flaw, `CVE-2026-4038`, affects **Aimogen Pro** through version `2.7.5` and enables **unauthenticated privilege escalation** through an arbitrary function call in `aiomatic_call_ai_function_realtime` caused by a missing capability check. According to the disclosure, attackers can invoke WordPress functions such as `update_option` to change the default registration role to administrator and enable user registration, effectively creating a path to full site takeover. The vulnerability is tracked as `CWE-862` and was likewise rated with a high-impact `CVSS 3.1` vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`.
Jun 29, 2026