Unauthenticated PHP Object Injection in Give - Tributes WordPress Plugin

The Give - Tributes WordPress plugin, an add-on for the GiveWP core, contains a critical vulnerability tracked as CVE-2026-19658. The issue stems from the improper handling of serialized donation meta data. When the 'Allow Multiple Recipients' feature is enabled for eCards and the 'eCard custom message' feature is disabled, the plugin stores raw $_POST data directly into the database. Specifically, the insert_tribute_data() function processes unsanitized recipient fields such as first_name and last_name without adequate validation. An unauthenticated attacker can supply a malicious PHP serialized object within these fields during the donation process. While the plugin itself does not contain a PHP Object Injection (POI) gadget chain, the injected object is deserialized when administrative functions, such as eCard previews or resending donation receipts, are executed. If other installed plugins or the active theme contain suitable gadgets, this can be escalated to remote code execution (RCE). The vulnerability was fixed in version 2.3.1.1.

Attack Chain

1. Attacker identifies a WordPress target with the GiveWP core and the Give - Tributes plugin (version <= 2.3.1) installed.
2. Attacker verifies that the target has a legacy GiveWP donation form (v2) enabled with 'Allow Multiple Recipients' configured.
3. Attacker initiates a donation request, providing a crafted serialized PHP object within the second recipient's first_name parameter of the give_tributes_ecard_notify array.
4. The plugin receives the POST request and saves the unsanitized serialized object into the donation metadata via the vulnerable insert_tribute_data() function.
5. The attacker completes or triggers the donation processing to finalize the storage of the malicious payload.
6. An administrator accesses the donation management dashboard to preview or resend a tribute receipt.
7. The application retrieves the tainted metadata and calls a deserialization function on the payload.
8. If an appropriate gadget chain exists within the WordPress environment, the attacker achieves arbitrary code execution within the context of the web server.

Impact

Successful exploitation allows for arbitrary code execution in the context of the web server, contingent on the presence of a compatible gadget chain within the victim's WordPress environment. This could lead to full site compromise, exfiltration of sensitive donor information, or lateral movement within the hosting environment. The vulnerability is rated at 9.8 (Critical) on the CVSS 3.1 scale due to the lack of required authentication or user interaction.

Recommendation

Prioritized actions for security and IT operations teams:

• Upgrade the 'Give - Tributes' WordPress plugin to version 2.3.1.1 or later immediately.
• If upgrading is not immediately possible, disable the 'Allow Multiple Recipients' feature in the plugin settings.
• Audit all installed plugins and themes for known POP chain gadgets to reduce the attack surface.
• Implement web application firewall (WAF) rules to inspect give_tributes_ecard_notify POST parameters for serialized object patterns (e.g., O:\d+:").
• Monitor server access logs for anomalous POST requests directed at donation forms containing serialized data signatures.