A maximum-severity vulnerability has been discovered in the GiveWP plugin for WordPress, a popular donation management plugin. The flaw allows unauthenticated attackers to execute arbitrary commands on the hosting server without any credentials. This type of vulnerability is classified as Remote Code Execution (RCE) and poses a critical risk to all WordPress sites running the affected plugin. The vulnerability could allow attackers to fully compromise affected web servers, steal data, or deploy malware. WordPress site administrators using GiveWP are strongly advised to update the plugin immediately to a patched version. The severity of the flaw is rated maximum, indicating a CVSS score at or near 10.0.
CVE-2026-82222 is a maximum-severity PHP object injection vulnerability in the GiveWP WordPress donation plugin affecting versions through 4.16.7.1. Exploitation chains three distinct issues: (1) an unsafe PHP deserialization helper, (2) a donation-processing flow that stores attacker-controlled serialized objects, and (3) a gadget chain in bundled libraries that can invoke arbitrary system commands. Although exploitation nominally requires an authenticated account, the plugin exposes an unauthenticated registration action (give_action=user_register) that bypasses the WordPress 'users_can_register' setting, allowing attackers to self-register even on sites with registration disabled. After obtaining an authentication cookie, the attacker stores a malicious serialized object in their profile and injects it into the plugin's session database (wp_give_sessions) by submitting a crafted donation request. The server responds with HTTP 500 but writes the gadget object to the session store. When any front-end page is subsequently requested with the attacker's authentication cookie, the server deserializes the gadget and executes arbitrary system commands. Exploitation is limited to sites running versions 4.16.6 through 4.16.7.1 that contain a legacy donation form without 'formBuilderSettings', which may exist in upgraded installations, sites using the option-based form editor, or those importing/restoring older forms. The vulnerability was reported by researcher Udin Chan on July 28 via Patchstack.
1. Immediately update the GiveWP plugin to version 4.16.7.2 or later, released on August 27, which blocks serialized data during donation processing and restricts object creation at deserialization points. 2. Note that version 4.16.7.2 also removes previously stored serialized object payloads from affected databases. 3. Audit your installation for legacy donation forms lacking 'formBuilderSettings', as these are required for exploitation. 4. Review site user registrations for unexpected or suspicious accounts that may have been created via the unauthenticated registration bypass. 5. Monitor the wp_give_sessions database table for anomalous serialized object entries. 6. Monitor for unexpected outbound connections or command execution from the web server process. 7. Be aware that even after patching, the unauthenticated registration action (give_action=user_register) still does not honor WordPress user registration settings, though it is no longer exploitable for code execution.
HTTP parameter: give_action=user_register (unauthenticated registration action), Database table: wp_give_sessions (location where malicious serialized gadget objects are stored), HTTP 500 response during crafted donation submission containing serialized payload
