CVE-2025-0912

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-0912
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-0912.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-0912
Published
2025-03-04T04:15:11.390Z
Modified
2026-04-10T05:21:00.833723Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserialization of untrusted input from the Donation Form through the 'card_address' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution.

References

Affected packages

Git / github.com/impress-org/givewp

Affected ranges

Type
GIT
Repo
https://github.com/impress-org/givewp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ccb2fbe01511d50cf5098ca8ff3c47dd0d8b1ef7
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.20.0"
        }
    ]
}

Affected versions

1.*
1.0
1.0.0
1.0.1
1.1
1.18.18
1.2
1.2.1
1.3
1.3.0.4
1.3.1
1.3.1.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.5
1.5.1
1.5.2
1.6
1.6.1
1.6.2
1.6.3
1.6.4
1.7
1.7.1
1.7.2
1.8
1.8.1
1.8.10
1.8.11
1.8.12
1.8.13
1.8.14
1.8.15
1.8.16
1.8.17
1.8.19
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.8.7.1
1.8.8
1.8.9
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.11.0
2.11.1
2.11.2
2.11.3
2.12.0
2.12.1
2.12.2
2.12.3
2.13.0
2.13.1
2.13.2
2.13.3
2.13.4
2.14.0
2.15.0
2.16.0
2.16.1
2.16.2
2.17.0
2.17.1
2.17.2
2.17.3
2.18.1
2.19.0
2.19.1
2.19.2
2.19.3
2.19.4
2.19.5
2.19.6
2.19.6-alpha
2.19.7
2.19.8
2.20.0
2.20.1
2.20.2
2.21.0
2.21.1
2.21.2
2.21.4
2.22.0
2.22.1
2.22.2
2.22.3
2.23.0
2.23.1
2.23.2
2.24.0
2.24.1
2.24.2
2.25.0
2.29.2
2.30.0
2.31.0
2.31.1
2.32.0
2.33.0
2.33.1
2.33.2
2.33.3
2.33.4
2.33.5
2.5.10
2.5.12
2.5.13
2.5.2
2.5.3
2.5.4
2.5.5
2.5.7
2.5.8
2.5.9
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.8.0
2.8.0-alpha.1
2.8.0-alpha.2
2.8.0-beta.1
2.8.0-beta.2
2.8.0-beta.3
2.8.0-rc.1
2.8.1
2.9.0
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
2.9.7
3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.10.0
3.11.0
3.12.0
3.13.0
3.14.0
3.14.1
3.15.0
3.16.0
3.16.2
3.16.3
3.16.4
3.16.5
3.17.0
3.17.2
3.18.0
3.19.1
3.19.2
3.2.0
3.2.1
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.8.0
3.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-0912.json"