A critical vulnerability in the GiveWP plugin for WordPress, identified as CVE-2026-82222, allows an unauthenticated attacker to execute arbitrary commands on the hosting server. The flaw affects GiveWP versions up to and including 4.16.7.1. The plugin, which has over 100,000 installations, is used for collecting donations and managing fundraising campaigns.
The vulnerability was reported by security researcher Udin Chan on July 28 through the Patchstack vulnerability intelligence platform. Exploitation of the flaw involves chaining three distinct issues: an unsafe helper for deserializing PHP data, a donation-processing flow that stores attacker-controlled serialized objects, and a gadget chain within libraries bundled with the plugin that can invoke arbitrary system commands.
While successful exploitation typically requires an attacker to have an account on the target site, an exposed unauthenticated registration action (give_action=user_register) in GiveWP allows for account creation even when site registration is disabled in WordPress settings. This means an attacker can create an account, obtain an authentication cookie, and then proceed with the attack sequence.
Once authenticated, an attacker can store a malicious serialized object in their user profile. This object is then injected into the plugin's session database by submitting a specially crafted donation. The server writes the gadget object into `wp_give_sessions` before returning an HTTP 500 error. Subsequently, requesting any front-end page with the authentication cookie causes the server to deserialize the gadget, executing the attacker's command.
Versions 4.16.6 through 4.16.7.1 remain vulnerable, though exploitation in these specific versions requires the presence of a legacy donation form lacking `formBuilderSettings`. Such conditions might exist in upgraded installations, sites utilizing the plugin's option-based form editor, or when importing or restoring older forms.
GiveWP released version 4.16.7.2 on August 27 to address the vulnerability. The update blocks serialized data during donation processing and restricts object creation at several deserialization points. Additionally, the security update removes serialized object payloads already stored in affected databases. While the registration action in GiveWP still does not honor WordPress user registration settings, this specific issue is no longer exploitable for code execution.
Website administrators using GiveWP are strongly advised to apply the security updates immediately to protect against potential exploitation of CVE-2026-82222. This is not the first time GiveWP has been targeted; last year, attackers exploited the plugin to indirectly breach Pi-hole, a network-level ad-blocker, exposing the names and email addresses of 30,000 donors.
