Security Research

CVE-2024-12877 GiveWP PHP Object Injection: When unserialize Meets Magic Methods

#Vulnerability Analysis#Code Audit#Web Security
CVE-2024-12877 GiveWP PHP Object Injection: When unserialize Meets Magic Methods

GiveWP calls unserialize() on user-controlled fields, and PHP automatically fires magic methods when deserializing. An attacker only needs to ship an object with the right magic method — PHP itself will run the attacker’s code, bypassing the early is_serialized regex that only recognized array and object types.

Unlock to view this content.