This vulnerability (CVE-2024-37099) in Liquid Web's GiveWP plugin is classified as CWE-502, deserialization of untrusted data. It allows an attacker to perform object injection by exploiting the deserialization process. The affected versions include all releases up to 3.14.1. The CVSS 3.1 base score is 10.0, reflecting network attack vector, no privileges required, no user interaction, and complete compromise of confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the vulnerability is not related to a cloud service.

Successful exploitation could lead to full system compromise including complete loss of confidentiality, integrity, and availability of the affected system running GiveWP. This could allow remote attackers to execute arbitrary code or manipulate application data without any authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting access to the affected GiveWP plugin and monitor for updates from Liquid Web. Avoid processing untrusted serialized data if possible.