GoKawiilA maximum-severity vulnerability in the GiveWP plugin for WordPress allows an unauthenticated attacker to execute arbitrary commands on the hosting server.
The security issue is identified as CVE-2026-82222 and affects GiveWP through version 4.16.7.1. It was reported by bug researcher Udin Chan on July 28 through the Patchstack vulnerability intelligence platform.
The GiveWP plugin has more than 100,000 installs and allows collecting donations and managing fundraising campaigns.
Patchstack researchers explain that exploiting the vulnerability is possible by chaining three distinct issues:
An unsafe helper for unserializing PHP data A donation-processing flow that stores attacker-controlled serialized objects A gadget chain in libraries bundled with the plugin that can invoke arbitrary system commands
Successful exploitation depends on the attacker having an account on the target site. However, Patchstack says that an exposed unauthenticated registration action allows creating an account even if registration is disabled.
“[GiveWP] exposes an unauthenticated registration action (give_action=user_register) that never consults the WordPress users_can_register option,” Patchstack explains.
“Even on a site that has registration disabled, the attacker can create an account and receive an authentication cookie, then carry out the rest of the attack in the same sequence.”
After authentication, hackers can store a malicious serialized object in their profile and inject it into the plugin’s session database by submitting a crafted donation.
"The server writes the gadget object into wp_give_sessions before returning an HTTP 500," says George Johnstone, cybersecurity researcher at Patchstack.
... continue reading