Security Alert Summary
The Give Tributes plugin for WordPress is affected by a PHP Object Injection vulnerability (CVE-2026-19658) in all versions up to and including 2.3.1. The issue involves deserialization of untrusted input and can be reached only when specific plugin options are set. The vulnerability does not include a known POP chain in the plugin itself, so exploitation depends on the presence of another installed plugin or theme that provides a gadget chain.
CVE Details
- CVE ID: CVE-2026-19658
- Affected component: Give Tributes plugin for WordPress
- Affected versions: All versions up to and including 2.3.1
- Published: September 22, 2026 at 05:16:55 AM UTC
- Last modified: September 22, 2026 at 11:17:23 AM UTC
- CVSS v3.1: base score 9.8, severity CRITICAL, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Authentication / privileges / user interaction: No authentication required; privileges required: none; user interaction: none
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- CWE / weakness ID: CWE-502
Technical Details
This vulnerability is a PHP Object Injection via deserialization of untrusted input in Give Tributes. The plugin deserializes input that an unauthenticated attacker can supply when the donation form is configured in certain ways. There is no known POP (property-oriented programming) chain inside the Give Tributes plugin itself; therefore, the vulnerability only leads to actionable impact if an additional plugin or theme installed on the same site contains a compatible POP chain.
Specific plugin behaviors that affect reachability are described in the advisory:
- The vulnerability is only reachable when the “Allow Multiple Recipients” option is enabled for the donation form. When the single-recipient code path is used, the plugin applies
sanitize_textarea_field(), which would neutralize the serialized payload. - Exploitation additionally requires the eCard “Custom Message” option to be disabled (this is the plugin default). If the custom message is enabled, GiveWP’s
give_clean()function blanks serialized input during validation, causing the donation to be rejected before it is stored.
When a compatible POP chain is present from another plugin or theme, an attacker could potentially use the injected object to perform actions such as deleting arbitrary files, retrieving sensitive data, or executing code, depending on the gadgets available in that chain. Without such a chain, the deserialization alone does not result in these impacts.
How This Could Impact Your Website
Consider a site with multiple users: a site owner who manages plugins and settings, internal staff who manage donations, and external contractors or contributors who may assist with content or promotions. If the site runs Give Tributes with “Allow Multiple Recipients” enabled and the eCard custom message disabled, an unauthenticated attacker could submit crafted serialized data. If another plugin or theme on the site provides a POP chain, that attacker might be able to perform actions such as accessing sensitive data or modifying files, which could expose internal user information like email addresses and increase the risk of targeted phishing or social engineering attacks against staff and contributors.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and other low-privilege accounts with content submission abilities.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes to reduce the chance that a POP chain is present on the site.
- Monitor site activity and logs for unusual behavior related to donation submissions or file changes.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
