A maximum-severity vulnerability in the GiveWP WordPress plugin allows unauthenticated attackers to execute arbitrary commands on the hosting server. The flaw, tracked as CVE-2026-82222, affects all GiveWP versions through 4.16.7.1 and impacts a plugin with more than 100,000 active installs used for collecting donations and managing fundraising campaigns.
The issue was reported by researcher Udin Chan on July 28 through the Patchstack vulnerability intelligence platform. According to Patchstack, exploitation requires chaining three separate weaknesses: an unsafe helper used for unserializing PHP data, a donation-processing flow that stores attacker-controlled serialized objects, and a gadget chain in libraries bundled with the plugin capable of invoking system commands.
No account? No problem
Normally, successful exploitation would require an attacker to already hold an account on the target site. However, Patchstack found that GiveWP exposes an unauthenticated registration action (give_action=user_register) that never checks WordPress’s users_can_register setting. This means attackers can create an account and obtain an authentication cookie even on sites where registration has been explicitly disabled.
Once authenticated, an attacker stores a malicious serialized object in their profile and injects it into the plugin’s session database by submitting a specially crafted donation. Patchstack researcher George Johnstone noted that the server writes the gadget object into the wp_give_sessions table before returning an HTTP 500 error. Simply requesting any front-end page while holding the authentication cookie then triggers unserialization of the gadget and execution of the attacker’s command.
Versions 4.16.6 through 4.16.7.1 are vulnerable, though exploitation depends on the site containing a legacy donation form lacking ‘formBuilderSettings.’ Patchstack notes such conditions can exist in upgraded installations, sites using the option-based form editor, or when older forms have been imported or restored.
Patch available
GiveWP fixed the vulnerability in version 4.16.7.2, released on August 27, by blocking serialized data during donation processing, restricting object creation at multiple deserialization points, and purging any serialized object payloads already stored in affected databases. Patchstack notes the registration action still does not respect WordPress registration settings, but the flaw is no longer exploitable for code execution as a result of the update.
Administrators running GiveWP are urged to update to 4.16.7.2 immediately. GiveWP was previously targeted last year in an attack chain that indirectly breached Pi-hole, exposing names and email addresses belonging to 30,000 donors.