CVE-2024-5977

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.13.0 via the 'handleRequest' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with GiveWP Worker-level access and above, to delete and update arbitrary posts.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Jul 19, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-59797.5In h2oai/h2o-3 version 3.46.0, the `run_tool` command in the `rapids` component allows the `main` function of any class under the `water.too CVE-2024-59809.8A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extrac CVE-2024-59819.8A vulnerability was found in itsourcecode Online House Rental System 1.0. It has been classified as critical. Affected is an unknown functio CVE-2024-59829.8A path traversal vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability arises from unsanitized input h CVE-2024-59839.8A vulnerability was found in itsourcecode Online Bookstore 1.0. It has been declared as critical. Affected by this vulnerability is an unkno CVE-2024-59849.8A vulnerability was found in itsourcecode Online Bookstore 1.0. It has been rated as critical. Affected by this issue is some unknown functi CVE-2024-59858.8A vulnerability classified as critical has been found in SourceCodester Best Online News Portal 1.0. This affects an unknown part of the fil CVE-2024-59869.1A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server. This is achieved CVE-2024-59874.3The WP Accessibility Helper (WAH) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check CVE-2024-59889.8Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke a local or remote executable and CVE-2024-59899.8Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke SQL injection into the program a CVE-2024-59907.5Due to an improper input validation, an unauthenticated threat actor can send a malicious message to a monitor thread within Rockwell Automa