CVE-2026-82222 — a maximum-severity flaw in the GiveWP WordPress donation plugin — lets an unauthenticated attacker ultimately run arbitrary commands on the hosting server, researchers warn.
How three chained flaws yield remote command execution
Patchstack researchers traced exploitation to a three-part chain that together permit server command execution. The pieces are: an unsafe helper that unserializes PHP data; a donation-processing flow that stores attacker-controlled serialized objects; and a gadget chain in libraries bundled with the plugin that can invoke arbitrary system commands, Patchstack says.
Successful exploitation requires that the attacker obtain an account on the target site. Patchstack explained that, once authenticated, an attacker can store a crafted serialized object in their profile and then submit a tailored donation that injects the gadget into the plugin’s session database. “The server writes the gadget object into wp_give_sessions before returning an HTTP 500,” said George Johnstone, a cybersecurity researcher at Patchstack. A later request for any front-end page containing the authentication cookie causes the server to unserialize the gadget and execute the command supplied by the attacker.
Registration bypass: give_action=user_register and account creation
Patchstack reported the issue through the Patchstack vulnerability intelligence platform on July 28, and credited bug researcher Udin Chan with the discovery. The researchers highlighted an unauthenticated registration action — give_action=user_register — that “never consults the WordPress users_can_register option.” In Patchstack’s words: “Even on a site that has registration disabled, the attacker can create an account and receive an authentication cookie, then carry out the rest of the attack in the same sequence.”
Patchstack later noted that GiveWP’s registration action still does not honor WordPress user registration settings, but that this remaining inconsistency is no longer exploitable for code execution after the vendor’s update.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageWhich sites and versions are at risk
The vulnerability, tracked as CVE-2026-82222, affected GiveWP through version 4.16.7.1. Patchstack said versions 4.16.6 through 4.16.7.1 remain vulnerable, but exploitation requires the site to contain a legacy donation form that lacks the ‘formBuilderSettings’ property. Those conditions, researchers wrote, may exist in upgraded installations, sites using the plugin’s option-based form editor, or when administrators import or restore older forms.
GiveWP has more than 100,000 installs, meaning a substantial population of sites could have fit the necessary conditions until the fix was applied.
Vendor response: fixes in 4.16.7.2 and cleanup of stored payloads
GiveWP released a security update, version 4.16.7.2, on August 27. According to Patchstack, the update addressed the root problems by blocking serialized data during donation processing and restricting object creation at several deserialization points. The security update also removes serialized object payloads already stored in affected databases, closing both the injection and the stored payload vectors.
Patchstack’s disclosure emphasizes that administrators should apply the security update as soon as possible to prevent malicious exploitation of CVE-2026-82222.
What this means for site operators, security teams, and donors
- Site operators and WordPress administrators: Sites running GiveWP versions 4.16.6–4.16.7.1 should update to 4.16.7.2 immediately, and inspect for legacy donation forms lacking formBuilderSettings that could have been created before upgrades or by imported/restored forms.
- Security teams and incident responders: Because exploitation relies on authenticated accounts and stored serialized payloads, teams should look for unexpected user accounts and any anomalous entries written to wp_give_sessions or similar session stores. The Patchstack write-up and George Johnstone’s reproduction notes identify the wp_give_sessions insertion and an HTTP 500 response as part of the chain.
- Donors and email lists: GiveWP was targeted last year in an incident that indirectly breached Pi-hole, exposing the names and email addresses of 30,000 donors. That historical targeting underscores the risk to donor information when fundraising plugins are abused.
Patchstack also observed a broader operational point: once attackers are using valid credentials, traditional prevention measures can be significantly less effective. The Blue Report 2026, cited by Patchstack, measures defensive performance technique by technique across 338 million simulations and highlights how prevention drops sharply after initial access.
The technical chain in CVE-2026-82222 tied together a legacy data-handling helper, a disabled-registration bypass, and bundled library gadgets — a reminder that even non-core plugin features and bundled third-party code can convert a site-level account into full server control. Administrators running GiveWP should update to 4.16.7.2 and check for legacy forms or unexpected accounts; researchers have already removed serialized payloads in the vendor’s update, but local verification remains prudent.
Read the original Patchstack and disclosure reporting at Bleeping Computer: https://www.bleepingcomputer.com/news/security/givewp-wordpress-donation-plugin-flaw-lets-hackers-execute-server-commands/
