Executive brief
The Give Tributes WordPress plugin deserializes untrusted user input without proper validation, allowing unauthenticated attackers to inject malicious PHP objects. While the plugin itself contains no dangerous code to exploit this directly, an attacker can leverage gadget chains from other installed WordPress plugins or themes to achieve code execution, data theft, or file deletion. This vulnerability requires specific conditions: the "Allow Multiple Recipients" option must be enabled and the eCard "Custom Message" option must be disabled (the default configuration).
Technical details
A PHP Object Injection vulnerability exists in the Give Tributes plugin due to unsafe deserialization of untrusted input passed through the donation form when "Allow Multiple Recipients" is enabled. The single-recipient code path properly sanitizes input using sanitize_textarea_field(), but the multi-recipient path does not. Exploitation requires no authentication and is delivered via network (HTTP donation form submission). The actual impact depends on the availability of a POP (Property-Oriented Programming) chain in other installed WordPress plugins or themes; if present, attackers can execute arbitrary code, delete files, or exfiltrate data.
Affected products
- Give Tributes up to and including 2.3.1
Timeline
- 2026-09-22: disclosed