A maximum-severity security flaw has been disclosed in the WordPress GiveWP donation and fundraising plugin that exposes more than 100,000 websites to remote code execution attacks.
The flaw, tracked as CVE-2024-5932 (CVSS score: 10.0), impacts all versions of the plugin prior to version 3.14.2, which was released on August 7, 2024. A security researcher, who goes by the online alias villu164, has been credited with discovering and reporting the issue.
The plugin is ”vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the ’give_title’ parameter,” Wordfence said in a report this week.
Australia social media ban: Kids barred from apps as world-first policy kicks in
Australia’s world-first social media ban for children has taken effect, with throngs of teenagers waking up to find their accounts have gone dark. Others tell BBC they have already snuck past barriers and will continue scrolling and posting freely until…