The GiveWP plugin for WordPress suffers from a PHP Object Injection vulnerability (CWE-502) due to unsafe deserialization of untrusted data from the 'give_title' parameter. This flaw enables unauthenticated attackers to inject crafted PHP objects. The presence of a POP (Property Oriented Programming) chain allows attackers to escalate this to remote code execution and arbitrary file deletion. The vulnerability affects all versions up to 3.14.1 and has a CVSS 3.1 base score of 10.0, reflecting its critical impact and ease of exploitation over the network without privileges or user interaction.

Successful exploitation can lead to full system compromise, including remote code execution and deletion of arbitrary files. Confidentiality, integrity, and availability of the affected system are severely impacted. The vulnerability is exploitable remotely by unauthenticated attackers, increasing the risk profile significantly.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the vulnerable plugin functionality, disable or remove the GiveWP plugin if not essential, and monitor for updates from the vendor. Avoid exposing the affected parameter ('give_title') to untrusted input sources. Do not rely on generic mitigations as this is a critical deserialization vulnerability.