A critical remote code execution vulnerability in the GiveWP plugin allows unauthenticated attackers to gain full control over affected WordPress installations.

This is a deserialization of untrusted data flaw (CWE-502) that permits unauthenticated attackers to inject malicious PHP objects into the application. By leveraging this vulnerability, an attacker can achieve remote code execution on the underlying server.

The potential impact of this vulnerability is total system compromise, as it allows for unauthorized remote code execution without requiring any user credentials. Given the CVSS score of 10.0, this flaw poses a critical risk to data confidentiality, integrity, and availability, potentially leading to complete site takeover, data exfiltration, or the deployment of persistent backdoors.

Immediate Action: Update the GiveWP plugin to version 4.16.7.2 or higher immediately to apply the vendor-supplied security patch.

Proactive Monitoring: Review web server access logs for suspicious POST requests or unusual PHP object strings that may indicate attempts to exploit deserialization functions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rules to inspect incoming traffic for malicious serialized PHP payloads and block requests targeting the vulnerable plugin endpoints.

Public Exploit Available: Yes, a published PoC exists, as documented in the technical write-up by Patchstack.

This vulnerability represents the highest level of security risk due to its unauthenticated nature and the severity of impact. Organizations utilizing the GiveWP plugin must prioritize patching to version 4.16.7.2 or later immediately. If an update cannot be performed instantly, the plugin should be deactivated until remediation is complete to prevent potential compromise.