CVE-2026-82222: The Critical Vulnerability in GiveWP That Exposes WordPress to Command Execution

The GiveWP plugin for WordPress, used by over 100,000 sites to manage donations and fundraising campaigns, contains a maximum severity vulnerability. Identified as CVE-2026-82222, it allows an unauthenticated attacker to execute arbitrary commands on the server hosting the site. The flaw was reported on July 28, 2026 by researcher Udin Chan via the Patchstack vulnerability intelligence platform. The vendor released a fix with version 4.16.7.2 on August 27, 2026.

How the Attack Works, Step by Step

Exploiting the vulnerability requires chaining three distinct issues within the plugin. The first is an insecure helper for deserializing PHP data. The second is the donation processing flow, which stores serialized objects controlled by the attacker. The third is a gadget chain, a sequence of classes and methods present in libraries bundled with the plugin, capable of invoking arbitrary system commands.

To understand the risk, it's helpful to clarify what deserializing data in PHP means. Serialization turns an object into a string that can be saved or transmitted. Deserialization does the reverse: it reconstructs the object from the string. If an application deserializes user-supplied data without proper checks, an attacker can manipulate the string to trigger code execution. In GiveWP, the attacker exploits this weakness to turn a simple donation into command execution.

The attack starts with creating an account on the site. GiveWP exposes an unauthenticated registration action, reachable via the give_action=user_register parameter. This action never checks the WordPress users_can_register option. Even when the administrator has disabled public registration, an attacker can create an account and obtain an authentication cookie.

After authentication, the attacker stores a malicious serialized object in their profile. They then submit a crafted donation that writes the gadget to the plugin's session database table, wp_give_sessions. The server responds with an HTTP 500 error, but the payload is now stored. At this point, requesting any front-end page with the authentication cookie is enough: the server deserializes the gadget and executes the command.

Affected Versions and Exploitation Condition

The vulnerability affects GiveWP up to and including version 4.16.7.1. Versions 4.16.6, 4.16.7, and 4.16.7.1 remain vulnerable. However, actual exploitation requires that the site contains a legacy donation form lacking the formBuilderSettings setting. This condition can occur in updated installations, in sites using the options-based editor, or after importing or restoring older forms.

The fix was introduced with version 4.16.7.2, released on August 27, 2026. The update blocks serialized data during donation processing, restricts object creation in various deserialization points, and removes serialized payloads already present in compromised databases. This last point is important: those who have already experienced an exploitation attempt will find the payloads removed after updating.

A Maximum CVSS Score

The vulnerability received a CVSS score of 10 out of 10, the highest possible. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. In practice: network attack, low complexity, no privileges required, no user interaction, impact on all confidentiality, integrity, and availability components. This score reflects the extreme severity of the flaw: once exploited, it allows complete server compromise.

Risks for Sites, Donors, and Hosting Services

A successful attack allows arbitrary command execution on the hosting server. Consequences include data theft, site manipulation, installation of backdoors for persistence, and access to sensitive donor and user information. A GiveWP site's database may contain names, email addresses, and donation history.

The risk is not theoretical. In the past, attackers targeted GiveWP to indirectly breach Pi-hole, a well-known network-level ad blocker. That incident exposed the names and email addresses of 30,000 donors. The new flaw, if exploited at scale, could lead to similar or worse consequences, especially on shared servers where multiple sites reside on the same host. A single account created on a vulnerable site could become the entry point for the entire hosting environment.

Immediate Actions for Administrators

Administrators of WordPress sites using GiveWP must update immediately to version 4.16.7.2 or later. The update not only fixes the vulnerability but also removes serialized payloads already stored in compromised databases. No other specific mitigations are indicated besides the update.

After updating, it is advisable to check that no suspicious accounts have been created on the site and to review server logs for any abnormally executed commands. In environments with many WordPress sites, the update should be planned rapidly to prevent a single legacy form from becoming the entry point.

The Residual Problem of Exposed Registration

After the patch, the unauthenticated registration action still does not respect WordPress registration settings. However, it is no longer exploitable to achieve code execution. It remains a potential attack surface for other abuses, such as spam account creation or privilege escalation attempts, but currently does not pose a command execution risk. GiveWP developers should align this behavior with standard WordPress settings in future versions.