CVE-2024-5932 is a CVSS 10.0 (Critical) PHP object injection in the GiveWP donation plugin for WordPress, in all versions up to and including 3.14.1. Unauthenticated attackers can inject an object, and a POP chain allows remote code execution and arbitrary file deletion. Update past 3.14.1.
What's affected
The NVD record says GiveWP versions up to and including 3.14.1 deserialize untrusted input from the give_title parameter. The weakness is CWE-502, deserialization of untrusted data. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, which means network reachable, no account needed, and a changed scope.
The record says the plugin also contains a POP chain, which is a sequence of existing code that turns an injected object into real effects. Here that means code execution and deletion of arbitrary files.
I could not confirm the exact fixed version. The record only gives the vulnerable range, so the first release after 3.14.1 is the expected target, and you should verify it in the plugin changelog. The WordPress plugin page I loaded did not show an entry that names this issue. NVD is the only severity source I have, so there is no conflict to report. The record does not flag it as known exploited.
How to check if you're exposed
In the WordPress admin, open Plugins and read the GiveWP version. With WP-CLI on the server:
wp plugin list --name=give --fields=name,version,update
Anything at 3.14.1 or lower is in the range. Also check donation forms and the login and registration pages, since the record references code in the login, register and donation processing files.
What to do now
- Update GiveWP to the latest release, which is past 3.14.1, and read the changelog for the security note.
- If you cannot update at once, deactivate the plugin or take the donation pages offline.
- Review the site for unexpected files and changed or missing core files, since the record mentions file deletion.
- Rotate WordPress administrator passwords and database credentials if you see signs of tampering.
- Turn on automatic plugin updates for payment and donation plugins.
Why it matters
PHP object injection arises when an application rebuilds an object from user supplied data. If a class in the code base has useful side effects when it is created or destroyed, an attacker picks which class gets built. A POP chain links several such classes together.
The maximum score here reflects three things at once: no login, a network path, and code execution. Donation plugins also sit next to payment and donor data, so a compromised site is more than a defaced one.
Try it yourself
When a patched release exists, the quickest win is finding every place the old one still runs. This demo shows how that flow looks in practice.
Click through it at your own pace, or open it full screen.
Quick check
Is there a workaround?
The record lists none. Update the plugin or turn it off.
Does it need a logged in user?
No. The record says unauthenticated attackers can trigger it.
Sources
- NVD record for CVE-2024-5932
- GiveWP plugin page
- Gold entry
Last reviewed: 19 October 2026.
