GoKawiilCritical flaw in GiveWP WordPress plugin enables remote code execution
Security researchers disclosed CVE-2026-82222, a maximum-severity vulnerability in the GiveWP donation plugin affecting versions through 4.16.7.1. By chaining an unauthenticated registration bypass, an insecure PHP unserialize function, and a gadget chain in bundled libraries, attackers can create an account, plant a malicious object in the plugin's session data, and trigger arbitrary command execution on the server by simply loading a front-end page.
GoKawiil's interpretation of the reporting above, not reported fact.
GiveWP powers donation collection on more than 100,000 WordPress sites, many run by nonprofits and charities that may lack dedicated security staff, making them attractive and vulnerable targets. Because the exploit requires no valid credentials to start with, attackers can fully compromise a server—stealing donor data or planting malware—without needing any prior access, elevating the urgency for immediate patching.
- CVE-2026-82222 lets unauthenticated attackers execute commands on servers running vulnerable GiveWP versions.
- The exploit chains an unauthenticated account-creation flaw with insecure PHP deserialization and a gadget chain in bundled libraries.
- Site owners using GiveWP through version 4.16.7.1, especially with legacy donation forms, should update immediately.
YubiKey 5 NFC Security Key — When a WordPress plugin flaw can hand attackers an account on your site, locking down admin logins matters more than ever. The YubiKey 5 NFC plugs into USB-A or taps NFC phones for hardware-backed two-factor authentication, and it works with WordPress 2FA plugins as well as Google, Microsoft and password managers. It's a simple, physical layer of defense for anyone running a donation or fundraising site.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-08-28
Published there as: “GiveWP WordPress donation plugin flaw lets hackers execute server commands”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.