A critical vulnerability in the GiveWP WordPress donation plugin could allow unauthenticated attackers to execute arbitrary commands on vulnerable hosting servers.
Tracked as CVE-2026-82222, the security flaw affects GiveWP versions up to and including 4.16.7.1. Security researcher Udin Chan reported the vulnerability on July 28 through the Patchstack vulnerability intelligence platform.
GiveWP is used on more than 100,000 WordPress websites to collect donations, manage fundraising campaigns, and process donor information.
According to Patchstack researchers, attackers can exploit CVE-2026-82222 by chaining three separate weaknesses:
- An insecure helper used to deserialize PHP data.
- A donation-processing workflow that stores serialized objects controlled by an attacker.
- Gadget chains in libraries bundled with WordPress plugins that can execute arbitrary system commands.
Exploitation depends on the attacker obtaining an account on the targeted WordPress website. However, Patchstack found that GiveWP exposes a public registration action that can create accounts even when WordPress user registration is disabled.
“[GiveWP] exposes an unauthenticated registration action (give_action=user_register) that never references WordPress’ users_can_register option,” Patchstack explained in its vulnerability analysis.
As a result, an attacker may be able to create an account, obtain an authentication cookie, and continue with the remaining steps of the attack—even when site administrators have disabled public registration.
After authenticating, the attacker can place a malicious serialized object in their profile and inject it into the GiveWP session database by submitting a specially crafted donation request.
“The server writes the gadget object to wp_give_sessions before returning the HTTP 500,” Patchstack cybersecurity researcher George Johnstone said.
When the attacker later requests a front-end page while presenting the authentication cookie, the server deserializes the malicious object. This can trigger the gadget chain and execute attacker-controlled commands on the server.
GiveWP versions 4.16.6 through 4.16.7.1 are vulnerable when the website contains a legacy donation form that does not include formBuilderSettings.
Patchstack said legacy forms may remain on websites after upgrades, when administrators use the plugin’s options-based form editor, or after old forms have been imported or restored from backups.
GiveWP fixed the remote code execution vulnerability in version 4.16.7.2, released on August 27. The update blocks serialized data during donation processing and restricts object creation at multiple deserialization points.
The security release also removes serialized object payloads that may already be stored in affected WordPress databases.
Patchstack noted that GiveWP’s registration action still does not honor WordPress user registration settings. However, the remaining issue can no longer be used to achieve remote code execution after applying the security update.
WordPress administrators using GiveWP should update to version 4.16.7.2 or later immediately to protect their websites against potential exploitation of CVE-2026-82222. Administrators should also review user accounts, donation forms, server logs, and database activity for signs of unauthorized access.
GiveWP users were targeted in another attack last year that indirectly compromised Pi-hole, a popular network-level ad blocker, and exposed the names and email addresses of approximately 30,000 donors.
The overall prevention score can hide what happens after initial access. If an attacker uses valid credentials, your defenses can drop sharply.
Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com