CVE-2025-22777 is a critical (CVSS 9.8) PHP object injection flaw in GiveWP, the WordPress donation plugin by StellarWP. Versions up to and including 3.19.3 are affected, and an unauthenticated attacker can reach the bug. Patchstack lists 3.19.4 as the patched version, so update to it or later.
What's affected
The NVD record says GiveWP, plugin slug give, is affected from the first release through 3.19.3. Patchstack's entry gives the same range and names 3.19.4 as the patched release. It lists the required privilege as unauthenticated and the Patchstack priority as high.
Patchstack dates the report to 31 December 2024 and its publication to 10 January 2025.
How to check if you're exposed
With WP-CLI on the server:
wp plugin get give --field=version
wp plugin update give
In the WordPress admin, open Plugins and read the version under GiveWP. Anything at or below 3.19.3 needs the update. Since the plugin handles donations, also check that your payment gateway keys and admin accounts look normal if the site was unpatched for a while.
Reading an inventory is faster than checking host by host. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory you can search for any CVE. Reachability analysis helps you see whether a vulnerable component is actually used in your code, so you can fix the exposed ones first.
What to do now
- Update GiveWP to 3.19.4 or later.
- Confirm the version in the plugin list.
- Review administrator accounts and recently modified files on sites that ran an old version in public.
- Rotate payment gateway and API keys if you find signs of tampering.
- Subscribe to plugin advisories or scan your dependencies on a schedule.
Why it matters
CWE-502 is deserialization of untrusted data. PHP's unserialize() turns a string back into objects. When the string comes from a request, the sender influences which objects are built, and some classes run code when they are created or destroyed. That is called object injection, and the impact depends on which classes exist in the application and its plugins.
The fix is to stop passing untrusted data to unserialize(), or to restrict the allowed classes. The record does not mark this CVE as exploited, and the KEV flag is false, so no exploitation is claimed here. Even so, a critical, unauthenticated flaw in a public WordPress plugin is the kind that gets scanned for quickly.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
Patchstack lists 3.19.4 as the patched version. Versions up to and including 3.19.3 are affected.
Is a login required?
Patchstack lists the required privilege as unauthenticated.
Sources
Last reviewed: 19 October 2026.
