A critical security vulnerability in the GiveWP WordPress donation plugin could allow attackers to execute arbitrary commands on affected hosting servers. Tracked as CVE-2026-82222, the maximum-severity flaw affects GiveWP versions through 4.16.7.1.
GiveWP is used by more than 100,000 WordPress websites to accept donations and manage fundraising campaigns. The vulnerability was reported by security researcher Udin Chan on July 28 through the Patchstack vulnerability intelligence platform.
According to Patchstack researchers, the attack combines three separate security weaknesses. These include an unsafe PHP data unserialization helper, a donation-processing mechanism that stores serialized objects controlled by an attacker, and a gadget chain within libraries bundled with GiveWP that can ultimately execute system commands.
Although exploitation requires the attacker to have an account on the affected website, Patchstack found that GiveWP exposes an unauthenticated registration action that can be abused to create an account even when WordPress user registration has been disabled.
The vulnerable action, give_action=user_register, does not check WordPress’s users_can_register setting. This means an attacker can potentially create an account, receive an authentication cookie, and continue with the remaining stages of the attack.
Once authenticated, the attacker can place a malicious serialized object in their profile and then inject it into the plugin’s session database through a specially crafted donation. Patchstack researcher George Johnstone explained that the server stores the malicious gadget object in the wp_give_sessions table before returning an HTTP 500 error.
The attack can then be triggered by requesting a front-end page while using the authentication cookie. During processing, the server unserializes the malicious object, allowing the gadget chain to execute a command chosen by the attacker.
The vulnerability affects GiveWP versions 4.16.6 through 4.16.7.1, although successful exploitation requires the website to contain a legacy donation form without formBuilderSettings. Patchstack says this condition can occur on upgraded websites, installations using the plugin’s option-based form editor, or sites where older donation forms have been imported or restored.
GiveWP addressed the vulnerability in version 4.16.7.2, released on August 27. The update blocks serialized data during donation processing and adds restrictions around object creation at multiple deserialization points. It also removes serialized object payloads that may already have been stored in affected databases.
Patchstack notes that the registration action still does not follow WordPress’s user-registration setting, but the remaining issue can no longer be used to achieve code execution following the security fixes.
Administrators running GiveWP are strongly advised to update to version 4.16.7.2 or later as soon as possible to protect their websites from potential exploitation of CVE-2026-82222.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
GiveWP was also involved in a security incident last year when attackers exploited the plugin as part of an attack against Pi-hole. The incident exposed the names and email addresses of approximately 30,000 donors.
