A maximum-severity vulnerability in the GiveWP plugin for WordPress allows an unauthenticated attacker to execute arbitrary commands on the hosting server.
The security issue is identified as CVE-2026-82222 and affects GiveWP through version 4.16.7.1. It was reported by bug researcher Udin Chan on July 28 through the Patchstack vulnerability intelligence platform.
The GiveWP plugin has more than 100,000 installs and allows collecting donations and managing fundraising campaigns.
Patchstack researchers explain that exploiting the vulnerability is possible by chaining three distinct issues:
- An unsafe helper for unserializing PHP data
- A donation-processing flow that stores attacker-controlled serialized objects
- A gadget chain in libraries bundled with the plugin that can invoke arbitrary system commands
Successful exploitation depends on the attacker having an account on the target site. However, Patchstack says that an exposed unauthenticated registration action allows creating an account even if registration is disabled.
“[GiveWP] exposes an unauthenticated registration action (give_action=user_register) that never consults the WordPress users_can_register option,” Patchstack explains.
“Even on a site that has registration disabled, the attacker can create an account and receive an authentication cookie, then carry out the rest of the attack in the same sequence.”
After authentication, hackers can store a malicious serialized object in their profile and inject it into the plugin’s session database by submitting a crafted donation.
“The server writes the gadget object into wp_give_sessions before returning an HTTP 500,” says George Johnstone, cybersecurity researcher at Patchstack.
By requesting any front-end page with the authentication cookie, the server unserializes the gadget and executes the command from the attacker.
Versions 4.16.6 through 4.16.7.1 remain vulnerable, although exploitation requires the site to contain a legacy donation form without ‘formBuilderSettings.’
Patchstack comments that such conditions may exist in upgraded installations, sites using the plugin’s option-based form editor, or when importing or restoring older forms.
GiveWP fixed the vulnerability in version 4.16.7.2, released on August 27, by blocking serialized data during donation processing and restricting object creation at several deserialization points.
Additionally, the security update removes serialized object payloads already stored in affected databases.
However, Patchstack notes that GiveWP’s registration action still does not honor WordPress user registration settings, but this issue is no longer exploitable for code execution.
Website administrators using GiveWP are urged to apply the security updates as soon as possible to prevent malicious exploitation of CVE-2026-82222.
Hackers targeted GiveWP last year to indirectly breach Pi-hole, a popular network-level ad-blocker, exposing the names and email addresses of 30,000 donors.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
