CVE-2026-19658 in Give Tributes Plugin
Summary
by MITRE • 09/22/2026
The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This vulnerability is only reachable when the "Allow Multiple Recipients" option is enabled for the donation form, as the single-recipient code path applies sanitize_textarea_field() which would neutralize the payload. Exploitation additionally requires the eCard "Custom Message" option to be disabled, which is the plugin default: when it is enabled the personalized message becomes a required field and GiveWP's give_clean() blanks serialized input during validation, causing the donation to be rejected before it is stored.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in the Give Tributes WordPress plugin affects all versions up to and including 2.3.1, presenting a critical risk of PHP Object Injection through the deserialization of untrusted user input. This flaw allows attackers who do not require authentication to inject malicious PHP objects into the application's processing pipeline. The core technical issue stems from the improper handling of serialized data within specific form submission workflows. When an attacker submits crafted input that contains serialized object representations, the plugin fails to validate or sanitize this data before passing it to PHP’s unserialize function. This lack of strict type checking and validation creates a direct pathway for arbitrary code execution if suitable gadget chains are available in the environment.
The operational impact of this vulnerability is contingent upon the presence of specific POP (Property-Oriented Programming) chains within the target WordPress installation. While the Give Tributes plugin itself does not contain known exploitable POP chains, it acts as a vector that can trigger vulnerabilities present in other installed plugins or themes. If an attacker successfully injects a serialized object and the site has another component with vulnerable magic methods, the resulting execution flow could lead to severe consequences such as arbitrary file deletion, exfiltration of sensitive database information, or full remote code execution. The severity is therefore dependent on the broader ecosystem of software running on the server, but the potential for privilege escalation and data compromise remains high when auxiliary vulnerabilities are present.
Exploitation of this vulnerability is restricted to specific configuration states within the plugin, which provides a partial mitigation through proper administrative setup. The attack vector is only accessible when the "Allow Multiple Recipients" option is enabled on the donation form settings. In configurations where single-recipient mode is active, the code path applies sanitize_textarea_field(), effectively neutralizing serialized payloads by stripping or escaping special characters required for object injection. Furthermore, exploitation requires that the eCard "Custom Message" feature remains disabled, which is the default setting in GiveWP. When this option is enabled, the personalized message field becomes mandatory and undergoes validation via give_clean(), a function that blanks out any serialized input during processing. This causes the donation submission to be rejected before storage, thereby preventing the deserialization of malicious data under these specific conditions.
To mitigate this risk, administrators should immediately update the Give Tributes plugin to version 2.3.2 or later where available, as updates typically address such serialization flaws by implementing stricter input validation and output encoding practices. In cases where an immediate patch is not feasible, disabling the "Allow Multiple Recipients" option serves as a effective temporary workaround that blocks the specific code path exploited in this vulnerability. Additionally, administrators should audit their WordPress installations for other plugins or themes with known vulnerabilities to reduce the likelihood of successful POP chain exploitation. Adhering to security standards such as CWE-502 regarding deserialization of untrusted data and aligning defense strategies with MITRE ATT&CK techniques related to code execution via injection can further harden the environment against similar attacks.