Critical GiveWP Flaw Lets Hackers Run Server Commands

What Happened

A maximum-severity vulnerability in GiveWP, a WordPress donation and fundraising plugin with more than 100,000 active installs, allows attackers to execute arbitrary commands on the hosting server. Tracked as CVE-2026-82222, the flaw affects GiveWP through version 4.16.7.1 and was fixed in 4.16.7.2, released August 27, 2026. It was reported through Patchstack on July 28 by researcher Udin Chan.

Incident Details

How It Works

The Vulnerability Chain

The flaw isn't a single bug but a chain of three separate issues: an unsafe PHP safeUnserialize() helper that fails to properly restrict deserialization, GiveWP's donation-processing flow storing attacker-controlled serialized objects in the database, and a gadget chain in libraries bundled with the plugin that turns that unsafe deserialization into arbitrary operating-system command execution. On version 4.16.5.1 and earlier, a default installation with any published donation form and an active payment gateway is enough on its own to be exploitable. Versions 4.16.6 through 4.16.7.1 narrowed the attack path but did not close the underlying deserialization flaw.

The Authentication Bypass

Exploiting the object-injection chain normally requires an authenticated account on the target WordPress site. GiveWP closes that gap for attackers on its own: Patchstack found the plugin exposes an unauthenticated registration action (give_action=user_register) that never checks WordPress's users_can_register setting — meaning an attacker can create an account and proceed with the exploit chain even on sites that have registration explicitly disabled.

The Fix

GiveWP's 4.16.7.2 update blocks serialized data from being accepted during donation processing, restricts object creation at the deserialization points involved in the chain, and ships a database migration that scrubs any malicious serialized objects that may already have been stored from prior exploitation attempts. The unauthenticated registration action itself was not removed in this release, though Patchstack notes it can no longer be chained into RCE once the object-injection path is closed.

Impact Assessment

Recommendations

For GiveWP Site Administrators

• Update to GiveWP 4.16.7.2 or later immediately — this is a critical, effectively unauthenticated remote code execution chain.
• Review the site's user list for any unexpected accounts created via the registration bypass, even on sites where registration was believed to be disabled.
• Check server and application logs for unusual outbound connections, unexpected file writes, or new admin/database changes dated after July 28 (the report date), in case exploitation occurred before the patch.

For WordPress Hosts and Agencies Managing Client Sites

• Treat this as a priority patch across any managed WordPress fleet running GiveWP, given the plugin's install base and the plugin's recurring history of object-injection vulnerabilities.
• Consider a web application firewall rule blocking unauthenticated requests to give_action=user_register as a stopgap on sites that cannot be patched immediately.

Key Takeaways

1. CVE-2026-82222 chains PHP object injection, unsafe deserialization, and a bundled gadget chain into full remote code execution in GiveWP.
2. A separate unauthenticated registration bypass (give_action=user_register) lets attackers create accounts even when registration is disabled, removing the usual authentication barrier.
3. Versions through 4.16.7.1 are affected; 4.16.7.2 (August 27, 2026) fixes the issue and scrubs malicious data via a database migration.
4. Over 100,000 active installs are exposed, many belonging to nonprofits and fundraising organizations.
5. GiveWP has a recurring history of PHP object injection flaws dating back to 2024, including a prior incident that indirectly exposed 30,000 Pi-hole donor records.
6. Site administrators should update immediately and audit for unexpected user accounts created before patching.

Sources

• BleepingComputer — GiveWP WordPress donation plugin flaw lets hackers execute server commands
• Patchstack — Critical Vulnerability Patched in GiveWP Plugin