A maximum-severity vulnerability in the GiveWP WordPress plugin could allow an unauthenticated attacker to execute arbitrary commands on the hosting server. The flaw, tracked as CVE-2026-82222, affects GiveWP through version 4.16.7.1. The plugin, which has more than 100,000 installs, is used to collect donations and manage fundraising campaigns. The issue was reported by bug researcher Udin Chan through the Patchstack vulnerability intelligence platform.
Patchstack researchers say exploitation is possible by chaining three distinct issues. The first requires the attacker to have an account on the target site, but an exposed unauthenticated registration action allows account creation even if registration is disabled. That action, triggered by give_action=user_register, never consults the WordPress users_can_register option. After authentication, a hacker can store a malicious serialized object in their profile and inject it into the plugin's session database by submitting a crafted donation.
The server writes the gadget object into wp_give_sessions before returning an HTTP 500 error, according to George Johnstone, a cybersecurity researcher at Patchstack. Versions 4.16.6 through 4.16.7.1 remain vulnerable, though exploitation requires the site to contain a legacy donation form without formBuilderSettings. Patchstack notes such conditions may exist in upgraded installations, sites using the plugin's option-based form editor, or when importing or restoring older forms.
GiveWP fixed the vulnerability in version 4.16.7.2, released on August 27. The update blocks serialized data during donation processing and restricts object creation at several deserialization points. It also removes serialized object payloads already stored in affected databases. Patchstack notes that GiveWP's registration action still does not honor WordPress user registration settings, but that issue is no longer exploitable for code execution.
Website administrators using GiveWP are urged to apply the security updates as soon as possible to prevent malicious exploitation of CVE-2026-82222. The advisory comes after hackers targeted GiveWP last year to indirectly breach Pi-hole, a popular network-level ad-blocker. That incident exposed the names and email addresses of 30,000 donors. The new flaw underscores the risk of supply-chain attacks on widely deployed WordPress plugins used by US-based nonprofits and fundraising organizations.
More cybersecurity news from TechManNews.
