CVE-2026-19658
Received Received - Intake

PHP Object Injection in Give Tributes WordPress Plugin

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: Wordfence

Description
The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This vulnerability is only reachable when the "Allow Multiple Recipients" option is enabled for the donation form, as the single-recipient code path applies sanitize_textarea_field() which would neutralize the payload. Exploitation additionally requires the eCard "Custom Message" option to be disabled, which is the plugin default: when it is enabled the personalized message becomes a required field and GiveWP's give_clean() blanks serialized input during validation, causing the donation to be rejected before it is stored.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-19658
EUVD
EUVD-2026-84269

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
givewp give to 2.3.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in versions up to 2.3.1 due to deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. Exploitation requires another plugin or theme with a POP chain to be installed, which could then allow actions like deleting files, retrieving sensitive data, or executing code. The vulnerability is only exploitable if the 'Allow Multiple Recipients' option is enabled and the eCard 'Custom Message' option is disabled.

Detection Guidance

Check if the Give Tributes plugin is installed and its version is up to 2.3.1. Inspect WordPress logs for unusual deserialization activity or failed donation submissions. Look for signs of PHP Object Injection in donation form submissions when 'Allow Multiple Recipients' is enabled and 'Custom Message' is disabled.

Impact Analysis

If exploited, this vulnerability could allow attackers to perform unauthorized actions on your WordPress site, such as deleting files, stealing sensitive data, or executing malicious code. This depends on whether another plugin or theme with a POP chain is installed. The risk is limited to sites using the vulnerable plugin version with specific settings enabled.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR or HIPAA if exploited to retrieve sensitive data or execute unauthorized actions. Exploitation may lead to unauthorized access to donor information, which could violate data protection requirements under these regulations.

Mitigation Strategies

Update the Give Tributes plugin to the latest version beyond 2.3.1. Disable the 'Allow Multiple Recipients' option in donation forms. Enable the 'Custom Message' option to neutralize serialized input. Review installed plugins and themes for POP chains and remove any suspicious ones.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19658. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart