CVE-2026-19658PoC

MEDIUMCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This vulnerability is only reachable when the "Allow Multiple Recipients" option is enabled for the donation form, as the single-recipient code path applies sanitize_textarea_field() which would neutralize the payload. Exploitation additionally requires the eCard "Custom Message" option to be disabled, which is the plugin default: when it is enabled the personalized message becomes a required field and GiveWP's give_clean() blanks serialized input during validation, causing the donation to be rejected before it is stored.

Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-502

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
14 mentions across 4 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 2 signals
PoC mentioned or linked in 9 signals
Patch or workaround mentioned in 3 signals
Technical details provided in 9 signals
Disclosure: 3 classified signals
Peaked 3d ago at 5 mentions (2026-09-22); latest day: 1
14 total mentions across 4 days

Deep dive

Activity timeline14 mentions / 4d

Signal classification5 categories

PoC

857.1%

Disclosure

321.4%

Exploit

17.1%

General

17.1%

Patch

17.1%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-22	5	Disclosure3Exploit1PoC1
2026-09-23	4	PoC4
2026-09-24	4	General1PoC3
2026-10-11	1	Patch1

Full discourse14 posts

ThreatWire@ThreatWire_45d
PoC
🚨 PoC RELEASED: A public PoC is now available for CVE-2026-19658, a CRITICAL PHP Object Injection vulnerability in the WordPress Give Tributes plugin (CVSS 9.8). The flaw allows unauthenticated attackers to inject PHP objects through deserialization of untrusted input. ⚠️ Versions up to and including 2.3.1 are affected. Exploitation requires “Allow Multiple Recipients” to be enabled, and the impact depends on a usable PHP POP chain being present in another installed plugin or theme. 🔴 Review affected installations and update when a fixed release is available. 🔗 https://github.com/murrez/cve-2026-19658 #WordPress #GiveTributes #CVE #PoC #CyberSecurity #Infosec
Post summary
The tweet announces the release of a public PoC for a critical PHP Object Injection vulnerability in the WordPress Give Tributes plugin, including a link to the exploit code.
07023112.0K
1.9K followersView on X
Ryx@PadhiyarRushi44d
PoC
GiveWP Tributes has an unauthenticated PHP Object Injection flaw. CVE-2026-19658 | CVSS 9.8!! The vulnerable path is reachable when: • Allow Multiple Recipients is enabled • eCard Custom Message is disabled Serialized attacker-controlled input can reach PHP object deserialization. Important detail: this is not automatically RCE. A usable POP chain from another installed plugin/theme is additionally required for code execution. Affected: Give Tributes ≤ 2.3.1. Public PoC tooling appeared on September 22. https://github.com/murrez/CVE-2026-19658 #Cybersecurity #Infosec #WordPress #PHP #Deserialization #AppSec
Post summary
The post describes CVE-2026-19658 as a high-severity PHP Object Injection vulnerability in GiveWP Tributes and highlights the public availability of PoC tooling with a linked repository. It does not report active exploitation or a patch.
01041380
954 followersView on X
ExploitGrid@exploitgrid45d
PoC
🚨 CRITICAL | WordPress Give Tributes CVE-2026-19658 affects the Give - Tributes WordPress add-on. 🔴 CVSS: 9.8 Critical 🎯 CWE-502 🔓 Unauthenticated 📌 Affected: ≤ 2.3.1 ✅ Fixed: 2.3.1.1+ A PoC has been released by @murrez.
Post summary
The tweet discloses CVE-2026-19658, a critical unauthenticated vulnerability (CVSS 9.8, CWE-502) in the WordPress Give Tributes add-on versions ≤2.3.1, notes a fix in version 2.3.1.1+, and highlights that a Proof of Concept has been released by @murrez.
1102051
403 followersView on X
ExploitGrid@exploitgrid44d
General
🛡️ #ExploitGrid Daily #Threat Digest Critical Exploits disclosed today: CVE-2026-28576 CVE-2024-2876 CVE-2026-13355 CVE-2026-19658 CVE-2026-41089 ..🧵👇
Post summary
The post is a threat digest that lists several CVEs as critical exploits disclosed today, but it contains no specific details, PoCs, exploit code, patches, or evidence of active exploitation.
2001077
305 followersView on X
MLAUNCHER@MLUNCHER46d
Disclosure
🚨 یک CVE جدید و Critical برای وردپرس CVE-2026-19658 🔴 CVSS: 9.8 📌 Give Tributes ≤ 2.3.1 این آسیب‌پذیری از نوع PHP Object Injection بوده و بدون نیاز به احراز هویت قابل تحریک است #امنیت #وردپرس #CVE #سایبری
Post summary
The tweet announces a new critical CVE for WordPress, providing CVSS score, vulnerability type, and affected version range.
1001062
11 followersView on X
mürrez@murrezsec46d
PoC
CVE-2026-19658 — Give Tributes ≤2.3.1: unauth PHP object injection (CWE-502, CVSS 9.8) on legacy Give donation forms when multi-recipient eCards are enabled. POP in another plugin/theme needed for real impact. https://github.com/murrez/CVE-2026-19658 #CVE #WordPress #GiveWP #AppSec
Post summary
The tweet discloses CVE-2026-19658, an unauthenticated PHP object injection in Give Tributes ≤2.3.1 with high CVSS, noting that a POP chain in another plugin/theme is required for impact, and shares a GitHub link likely containing a PoC.
00020101
636 followersView on X
ExploitGrid@exploitgrid44d
PoC
[EXPLOIT] CVE-2026-19658 [CRITICAL/PoC] CVE-2026-19658 🔗 https://exploitgrid.net/exploits/61767ce9-9368-4a2d-a06f-549db08480a1
Post summary
The text focuses on announcing CVE-2026-19658 as critical and emphasizes the availability of a Proof of Concept, directing to a link for details.
1000045
305 followersView on X
ExploitGrid@exploitgrid44d
PoC
💀 CRITICAL Exploits Trending ├ CVE-2026-41089 — Netlogon RCE · PoC live ├ CVE-2026-28576 · CVE-2024-2876 · PoC live └ CVE-2026-13355 · CVE-2026-19658 · PoC live +497 more tracked today.
Post summary
The tweet highlights several newly disclosed CVEs with publicly available proof‑of‑concept exploits, indicating they are becoming actively weaponized and trending in the threat landscape.
1000070
305 followersView on X
Rıdvan Yağlı@ridvanyagli46d
Disclosure
🔴 WordPress Give Tributes eklentisinde kritik PHP Object Injection açığı: CVE-2026-19658 2.3.1 ve önceki sürümleri etkileyen açık, kimlik doğrulaması gerektirmiyor ve CVSS 9.8 (Critical) olarak değerlendiriliyor. Açık, give_tributes_ecard_notify[recipient][personalized][] parametresinin güvensiz şekilde deserialize edilmesinden kaynaklanıyor. Give Tributes içerisinde bilinen bir POP chain bulunmuyor. Ancak sistemde başka bir eklenti veya temanın kullanılabilir bir POP chain'i mevcutsa keyfi dosya silme, hassas veri erişimi veya RCE mümkün olabilir. Açığın istismar edilebilmesi için bağış formunda Allow Multiple Recipients seçeneğinin etkin, eCard Custom Message seçeneğinin ise devre dışı olması gerekiyor.
Post summary
The text announces CVE-2026-19658, a critical PHP Object Injection vulnerability in the WordPress Give Tributes plugin (≤2.3.1, CVSS 9.8, no auth required), providing specific technical details including the vulnerable parameter and exploitation conditions, but mentions no PoC, exploit tool, patch, or active exploitation.
00100405
2.4K followersView on X
Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters27d
Patch
CVE-2026-19658: PHP Object Injection in GiveWP Give Tributes plugin, all versions up to 2.3.1. CVSS 9.8, unauthenticated. No patch yet - remove the plugin or update immediately. https://www.valtersit.com/cve/CVE-2026-19658 #CVE #WordPress #infosec #GiveWP #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
Post summary
The post describes an unauthenticated PHP Object Injection vulnerability in GiveWP Give Tributes and gives a CVSS score of 9.8. Although it says no patch is available, it recommends removing the plugin or updating immediately.
0000045
1.1K followersView on X
Rıdvan Yağlı@ridvanyagli45d
PoC
WordPress Give Tributes eklentisindeki CVE-2026-19658 açığı için murrez tarafından PoC yayınlandı. https://github.com/murrez/cve-2026-19658
Post summary
A proof-of-concept for CVE-2026-19658 affecting the WordPress Give Tributes plugin was published by murrez, accompanied by a GitHub repository link.
00000237
2.4K followersView on X
ExploitGrid@exploitgrid45d
PoC
Update Give - Tributes to 2.3.1.1+. The PoC includes a Python checker and FOFA helper to identify potential vulnerable installations. 🔗 https://github.com/murrez/CVE-2026-19658 #CyberSecurity #WordPress #CVE #InfoSec
Post summary
The text shares a proof of concept for CVE-2026-19658, including a Python checker and FOFA helper, while also noting the available patched version.
0000031
227 followersView on X
CERT-PY@CERTpy46d
Disclosure
⚠️ Vulnerabilidades en Complementos de WordPress ❗ CVE-2026-93485 ❗ CVE-2026-92438 ❗ CVE-2026-19658 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-complementos-de-wordpress-4/ https://t.co/xvy0fej6ZD
Post summary
The tweet discloses three WordPress plugin vulnerabilities (CVE-2026-93485, CVE-2026-92438, CVE-2026-19658) classified as zero-days for analysis, linking to a CERT advisory without sharing exploit code, active exploitation evidence, or specific technical details in the post.
00000248
6.7K followersView on X
dbugs@ptdbugs46d
Exploit
A PoC/exploit has been discovered for vulnerability CVE-2026-19658 PT ID: PT-2026-96645 Vendor: WordPress / LiquidWeb Product: Give Tributes Description: The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This vulnerability is only reachable when the "Allow Multiple Recipients" option is enabled for the donation form, as the single-recipient code path applies sanitize_textarea_field() which would neutralize the payload. Exploitation additionally requires the eCard "Custom Message" option to be disabled, which is the plugin default: when it is enabled the personalized message becomes a required field and GiveWP's give_clean() blanks serialized input during validation, causing the donation to be rejected before it is stored. References: • https://dbu.gs/vulnerability/PT-2026-96645 • https://github.com/murrez/cve-2026-19658
Post summary
The text discloses CVE-2026-19658, a PHP object injection vulnerability in the Give Tributes WordPress plugin, and states that a PoC/exploit has been discovered with a linked GitHub repository. It provides technical exploitation preconditions but does not report active exploitation or an official patch.
00000342
3.6K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-19658

ThreatWire[verified]@ThreatWire_PoC

The tweet announces the release of a public PoC for a critical PHP Object Injection vulnerability in the WordPress Give Tributes plugin, including a link to the exploit code.

Ryx[verified]@PadhiyarRushiPoC

The post describes CVE-2026-19658 as a high-severity PHP Object Injection vulnerability in GiveWP Tributes and highlights the public availability of PoC tooling with a linked repository. It does not report active exploitation or a patch.

Rıdvan Yağlı[verified]@ridvanyagliDisclosure

The text announces CVE-2026-19658, a critical PHP Object Injection vulnerability in the WordPress Give Tributes plugin (≤2.3.1, CVSS 9.8, no auth required), providing specific technical details including the vulnerable parameter and exploitation conditions, but mentions no PoC, exploit tool, patch, or active exploitation.

Hugo | DevOps | Cybersecurity 🇱🇻[verified]@HugoValtersPatch

The post describes an unauthenticated PHP Object Injection vulnerability in GiveWP Give Tributes and gives a CVSS score of 9.8. Although it says no patch is available, it recommends removing the plugin or updating immediately.

Rıdvan Yağlı[verified]@ridvanyagliPoC

A proof-of-concept for CVE-2026-19658 affecting the WordPress Give Tributes plugin was published by murrez, accompanied by a GitHub repository link.

dbugs[verified]@ptdbugsExploit

The text discloses CVE-2026-19658, a PHP object injection vulnerability in the Give Tributes WordPress plugin, and states that a PoC/exploit has been discovered with a linked GitHub repository. It provides technical exploitation preconditions but does not report active exploitation or an official patch.

ExploitGrid@exploitgridPoC

The tweet discloses CVE-2026-19658, a critical unauthenticated vulnerability (CVSS 9.8, CWE-502) in the WordPress Give Tributes add-on versions ≤2.3.1, notes a fix in version 2.3.1.1+, and highlights that a Proof of Concept has been released by @murrez.

ExploitGrid@exploitgridGeneral

The post is a threat digest that lists several CVEs as critical exploits disclosed today, but it contains no specific details, PoCs, exploit code, patches, or evidence of active exploitation.