Critical
GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injection
Type: advisorySources: OSV
The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserialization of untrusted input from the Donation Form through the 'card_address' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-0912
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 15:40 UTC · Revision 1
Source evidence
GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injection
core-osv · Original sourcePublished 4 Mar 2025, 03:37 UTC
The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserialization of untrusted input from the Donation Form through the 'card_address' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution.
osv:CVE-2025-0912
Complete source record
{
"id": "294b78cb93f7fbf60182e940710b8cd58139c0fb3f5d9edc954f6a0b32055cdc",
"url": "https://osv.dev/vulnerability/CVE-2025-0912",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injection",
"summary": "The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserialization of untrusted input from the Donation Form through the 'card_address' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution.",
"evidence": "osv:CVE-2025-0912",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2025-0912",
"aliases": [
"CVE-2025-0912"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/impress-org/givewp",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "ccb2fbe01511d50cf5098ca8ff3c47dd0d8b1ef7"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "3.19.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"cpe": "cpe:2.3:a:givewp:givewp:*:*:*:*:*:wordpress:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "3.20.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"3.19.2",
"3.19.1",
"3.18.0",
"3.17.2",
"3.17.0",
"3.16.5",
"3.16.4",
"3.16.3",
"3.16.2",
"3.16.0",
"3.15.0",
"3.14.1",
"3.14.0",
"3.13.0",
"3.12.0",
"3.11.0",
"3.10.0",
"3.9.0",
"3.8.0",
"3.7.0",
"3.6.0",
"3.5.0",
"3.4.1",
"3.4.0",
"3.2.1",
"3.2.0",
"3.0.3",
"3.0.2",
"3.0.1",
"3.0.0",
"2.33.5",
"2.33.4",
"2.33.3",
"2.33.2",
"2.33.1",
"2.33.0",
"2.32.0",
"2.31.1",
"2.31.0",
"2.30.0",
"2.29.2",
"2.25.0",
"2.24.2",
"2.24.1",
"2.24.0",
"2.23.2",
"2.23.1",
"2.23.0",
"2.22.3",
"2.22.2",
"2.22.1",
"2.22.0",
"2.21.4",
"2.21.2",
"2.21.1",
"2.21.0",
"2.20.2",
"2.20.1",
"2.20.0",
"2.19.8",
"2.19.7",
"2.19.6",
"2.19.6-alpha",
"2.19.5",
"2.19.4",
"2.19.3",
"2.19.2",
"2.19.1",
"2.19.0",
"2.18.1",
"2.17.3",
"2.17.2",
"2.17.1",
"2.17.0",
"2.16.2",
"2.16.1",
"2.16.0",
"2.15.0",
"2.14.0",
"2.13.4",
"2.13.3",
"2.13.2",
"2.13.1",
"2.13.0",
"2.12.3",
"2.12.2",
"2.12.1",
"2.12.0",
"2.11.3",
"2.11.2",
"2.11.1",
"2.11.0",
"2.10.4",
"2.10.3",
"2.10.2",
"2.10.1",
"2.10.0",
"2.9.7",
"2.9.6",
"2.9.5",
"2.9.4",
"2.9.3",
"2.9.2",
"2.9.1",
"2.9.0",
"2.8.1",
"2.8.0",
"2.8.0-rc.1",
"2.8.0-beta.3",
"2.8.0-beta.2",
"2.8.0-beta.1",
"2.8.0-alpha.1",
"2.8.0-alpha.2",
"2.7.5",
"2.7.4",
"2.7.3",
"2.7.2",
"2.7.1",
"2.7.0",
"2.6.3",
"2.6.2",
"2.6.1",
"2.6.0",
"2.5.13",
"2.5.12",
"2.5.10",
"2.5.9",
"2.5.8",
"2.5.7",
"2.5.5",
"2.5.4",
"2.5.3",
"2.5.2",
"2.0.5",
"2.0.4",
"2.0.3",
"2.0.2",
"2.0.1",
"2.0.0",
"1.8.19",
"1.18.18",
"1.8.17",
"1.8.16",
"1.8.15",
"1.8.14",
"1.8.13",
"1.8.12",
"1.8.11",
"1.8.10",
"1.8.9",
"1.8.8",
"1.8.7.1",
"1.8.7",
"1.8.6",
"1.8.5",
"1.8.4",
"1.8.3",
"1.8.2",
"1.8.1",
"1.8",
"1.7.2",
"1.7.1",
"1.7",
"1.6.4",
"1.6.3",
"1.6.2",
"1.6.1",
"1.6",
"1.5.1",
"1.5.2",
"1.5",
"1.4.5",
"1.4.4",
"1.4.3",
"1.4.2",
"1.4.1",
"1.4",
"1.3.6",
"1.3.5",
"1.3.4",
"1.3.3",
"1.3.2",
"1.3.1.1",
"1.3.1",
"1.3.0.4",
"1.3",
"1.2.1",
"1.2",
"1.1",
"1.0.1",
"1.0.0",
"1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-0912.json"
}
}
],
"modified": "2026-10-28T02:30:51.101451561Z",
"provider": "osv",
"references": [
"https://github.com/impress-org/givewp/pull/7679/files",
"https://plugins.trac.wordpress.org/changeset/3234114/give/trunk/src/Donations/Properties/BillingAddress.php",
"https://plugins.trac.wordpress.org/changeset/3234114/give/trunk/src/Donations/Repositories/DonationRepository.php",
"https://plugins.trac.wordpress.org/changeset/3234114/give/trunk/src/Donors/Repositories/DonorRepository.php",
"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3234114%40give&new=3234114%40give&sfp_email=&sfph_mail=",
"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a8ae1b0-e9a0-4179-970b-dbcb0642547c?source=cve",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0912.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-0912"
],
"provider_metadata": {
"cwe_ids": [
"CWE-502"
],
"cna_assigner": "Wordfence",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0912.json"
}
},
"related_cves": [
{
"value": "CVE-2025-0912",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 519782,
"published_at": "2025-03-04T03:37:59.369+00:00"
}