CVE-2026-19658: CWE-502 Deserialization of Untrusted Data in LiquidWeb Give Tributes
The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This vulnerability is only reachable when the "Allow Multiple Recipients" option is enabled for the donation form, as the single-recipient code path applies sanitize_textarea_field() which would neutralize the payload. Exploitation additionally requires the eCard "Custom Message" option to be disabled, which is the plugin default: when it is enabled the personalized message becomes a required field and GiveWP's give_clean() blanks serialized input during validation, causing the donation to be rejected before it is stored.
AI Analysis
Technical Summary
CVE-2026-19658 describes a PHP Object Injection vulnerability in the Give Tributes plugin for WordPress versions up to 2.3.1. It arises from unsafe deserialization of untrusted input when the "Allow Multiple Recipients" option is enabled and the eCard "Custom Message" option is disabled. Without a gadget POP chain from another plugin or theme, the vulnerability has no impact. If such a POP chain exists, attackers could leverage it to perform destructive or unauthorized actions. The vulnerability is unauthenticated and remote exploitable, with a high severity rating.
Potential Impact
If exploited in an environment where a suitable POP chain exists via other installed plugins or themes, attackers could delete arbitrary files, access sensitive data, or execute arbitrary code. Without such a POP chain, the vulnerability cannot be exploited to cause harm. The vulnerability is critical due to its potential impact on confidentiality, integrity, and availability.
Mitigation Recommendations
No official patch or fix is currently documented. Mitigation involves disabling the "Allow Multiple Recipients" option or enabling the eCard "Custom Message" option, which causes input sanitization that blocks exploitation. Additionally, removing or updating other plugins or themes that provide gadget POP chains can prevent exploitation. Monitor vendor advisories for official patches or updates.
CVE-2026-19658: CWE-502 Deserialization of Untrusted Data in LiquidWeb Give Tributes
Description
The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This vulnerability is only reachable when the "Allow Multiple Recipients" option is enabled for the donation form, as the single-recipient code path applies sanitize_textarea_field() which would neutralize the payload. Exploitation additionally requires the eCard "Custom Message" option to be disabled, which is the plugin default: when it is enabled the personalized message becomes a required field and GiveWP's give_clean() blanks serialized input during validation, causing the donation to be rejected before it is stored.
CVSS v3.1
Score 9.8critical
Affected software
LiquidWeb
Give Tributes
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-19658 describes a PHP Object Injection vulnerability in the Give Tributes plugin for WordPress versions up to 2.3.1. It arises from unsafe deserialization of untrusted input when the "Allow Multiple Recipients" option is enabled and the eCard "Custom Message" option is disabled. Without a gadget POP chain from another plugin or theme, the vulnerability has no impact. If such a POP chain exists, attackers could leverage it to perform destructive or unauthorized actions. The vulnerability is unauthenticated and remote exploitable, with a high severity rating.
Potential Impact
If exploited in an environment where a suitable POP chain exists via other installed plugins or themes, attackers could delete arbitrary files, access sensitive data, or execute arbitrary code. Without such a POP chain, the vulnerability cannot be exploited to cause harm. The vulnerability is critical due to its potential impact on confidentiality, integrity, and availability.
Mitigation Recommendations
No official patch or fix is currently documented. Mitigation involves disabling the "Allow Multiple Recipients" option or enabling the eCard "Custom Message" option, which causes input sanitization that blocks exploitation. Additionally, removing or updating other plugins or themes that provide gadget POP chains can prevent exploitation. Monitor vendor advisories for official patches or updates.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-08-12T18:57:11.799Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab20509f7a7c541066b8a24
Added to database: 09/22/2026, 04:33:13 UTC
Last enriched: 09/22/2026, 04:47:38 UTC
Last updated: 09/22/2026, 16:33:10 UTC
Views: 27
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.