CVE-2026-82222: Critical GiveWP flaw enables remote command execution — update to 4.16.7.2

A maximum‑severity vulnerability in GiveWP, a popular WordPress donations plugin with more than 100,000 installs, can lead to remote command execution on the hosting server. Tracked as CVE-2026-82222, the issue affects GiveWP up to version 4.16.7.1 and has been patched in 4.16.7.2.

According to reporting and the vendor-facing research summary, the flaw chains an unsafe PHP deserialization helper, a donation-processing path that stores attacker-controlled serialized objects, and a gadget chain in libraries bundled with the plugin. Patchstack credits researcher Udin Chan for reporting the issue on July 28, and BleepingComputer notes the fix was released on August 27.

What’s affected and what’s fixed

Both sources agree CVE-2026-82222 impacts GiveWP through 4.16.7.1. Patchstack’s technical write-up adds useful nuance on how reachable the full chain is across versions:

• On 4.16.5.1 and below, a default installation is enough to exploit.
• On 4.16.6 through 4.16.7.1, the vulnerability remains but typically requires the site to include a legacy donation form that lacks certain form settings. Patchstack notes such conditions may exist on upgraded sites, sites using the option-based form editor, or those importing or restoring older forms.

GiveWP 4.16.7.2 is reported to block serialized data during donation processing, restrict object creation across deserialization points, and proactively remove serialized object payloads already stored in affected databases. Patchstack also points out that GiveWP’s registration action still does not honor WordPress user registration settings after the fix, but this behavior is no longer exploitable for code execution.

How the attack chain works (high level)

The chain is notable for how it pivots from user profile data to server-side code execution:

• An attempt to “safely” unserialize data doesn’t neutralize malicious objects; it can store them intact for later reuse.
• The donation flow can read attacker-controlled data from a user account and persist it into a session table, where it is later unserialized without sufficient safeguards.
• A gadget chain in code shipped with the plugin can be triggered during object destruction, ultimately invoking dangerous functions and enabling arbitrary command execution as the web server user.

BleepingComputer also highlights a registration pathway that does not consult WordPress’s user registration setting. While exploitation of the main chain benefits from having an account, Patchstack’s analysis explains that the exposed registration action can allow an attacker to create one even when registration is disabled. In 4.16.6, a nonce requirement narrowed this behavior but did not fully eliminate it in all contexts.

Why it matters

GiveWP powers donation campaigns for nonprofits and other organizations that rely on trust and uptime. A route from unauthenticated access to server command execution raises the stakes for both site integrity and donor data. The combination of unsafe deserialization and legacy form configurations means even well-maintained sites could be at risk until the patched version is applied.

Practical next steps

• Update GiveWP to version 4.16.7.2 as soon as possible.
• After updating, test donation forms and payment gateways to confirm normal operation.
• Review recent user registrations for any unexpected accounts, especially if your site had WordPress registration disabled. Prior to the fix, GiveWP exposed a registration action that could create accounts regardless of that setting.
• Keep an eye on vendor and community advisories for any follow-up guidance.

Sources:

• BleepingComputer: “GiveWP WordPress donation plugin flaw lets hackers execute server commands” — https://www.bleepingcomputer.com/news/security/givewp-wordpress-donation-plugin-flaw-lets-hackers-execute-server-commands/
• Patchstack analysis (linked via NVD entry): “Unauthenticated PHP Object Injection to Remote Code Execution on GiveWP” — https://patchstack.com/articles/unauthenticated-php-object-injection-to-remote-code-execution-on-givewp/

What’s still unclear

The evidence here does not confirm whether CVE-2026-82222 is being actively exploited in the wild. It also does not provide a comprehensive list of all affected sub‑versions beyond “through 4.16.7.1,” nor does it quantify how many sites include the legacy form conditions that keep the chain reachable. Administrators should treat the risk as serious and prioritize the update, but avoid assuming compromise without supporting indicators.

Closing thoughts

CVE-2026-82222 is a reminder that “safe” helpers around dangerous primitives like unserialize() can create false confidence, and that legacy configuration can unexpectedly re‑expose critical paths. If your site uses GiveWP, the fix in 4.16.7.2 should be applied promptly, followed by routine checks for new or unusual user accounts and a quick validation of donation flows. Staying current is the most practical defense here.

Alex Mira

Alex Mira is a fictitious AI-assisted author created for the Toolslib blog. Designed to support cybersecurity education, Alex writes about malware trends, software utilities, privacy practices, Windows internals, and practical defensive workflows. Articles published under Alex’s name are generated or assisted by AI and reviewed according to Toolslib’s editorial standards before publication.