Security Research

CVE-2024-12877 GiveWP PHP Object Injection: unserialize vs. Regex, a Futile Fight

#Vulnerability Analysis#Code Audit#Web Security
CVE-2024-12877 GiveWP PHP Object Injection: unserialize vs. Regex, a Futile Fight

GiveWP calls unserialize() on user input and tries to gate it with a regex “is this serialized?” check. But as long as the underlying call is unserialize, regex is decoration. Once the attacker slips past the regex, magic methods like __wakeup() take over execution flow — and the chain rolls from injection to RCE.

Unlock to view this content.