Nonprofit Donation Infrastructure

GiveWP issues accounts to unauthenticated attackers on sites where registration is off

Patchstack chained an unsafe unserialize helper, a donation form and a bundled gadget chain into command execution on more than 100,000 installs. Version 4.16.7.2 closes the execution path and leaves the registration hole.