The LiquidWeb Give Tributes plugin for WordPress contains a critical PHP Object Injection vulnerability that allows unauthenticated attackers to potentially execute arbitrary code if specific environmental conditions are met.

This is a PHP Object Injection flaw (CWE-502) occurring through the deserialization of untrusted input. The vulnerability is accessible to unauthenticated attackers when the Allow Multiple Recipients option is enabled and the eCard Custom Message option is disabled.

Successful exploitation poses a critical risk to business operations, as it could lead to full system compromise, unauthorized data retrieval, or the deletion of arbitrary files. While the plugin itself lacks a native POP chain, the presence of other vulnerable themes or plugins on the same WordPress instance provides the necessary components for an attacker to achieve remote code execution. The CVSS score of 9.8 reflects the high potential for impact and the ease of exploitation given the lack of authentication required.

Immediate Action: Review the Give Tributes plugin configuration to ensure the Allow Multiple Recipients option is disabled until a security patch is released by the vendor.

Proactive Monitoring: Monitor server access logs for anomalous donation form submissions or unexpected serialized data patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious serialized PHP objects in incoming HTTP requests.

Public Exploit Available: Unknown.

Given the critical CVSS severity, administrators should prioritize securing affected installations by disabling the vulnerable plugin features immediately. Monitor the official LiquidWeb support channels for the release of a patched version and apply it as soon as it becomes available to ensure long-term protection against this deserialization flaw.