CVE-2026-19658 | CVSS: 9.8 | 严重级别: CRITICAL
The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sen
参考链接:
• https://www.liquidweb.com/software/give/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0cdd5562-8755-4ca3-9c1
📌 数据来源: NVD 官方