The GiveWP WordPress donation plugin, used by more than 100,000 sites, contains a maximum-severity vulnerability tracked as CVE-2026-82222. This flaw allows an unauthenticated attacker to execute arbitrary commands on the hosting server. Patchstack researcher Udin Chan reported the issue on July 28, 2026. GiveWP versions through 4.16.7.1 are affected, while version 4.16.7.2, released August 27, 2026, contains the fix. The vulnerability exists because of a chain of three distinct issues that together create a path from unauthenticated access to server command execution.
The CVE and Its Scope
GiveWP positions itself as a donation plugin for WordPress, enabling site owners to collect funds and manage fundraising campaigns. With over 100,000 active installs, the plugin's reach makes any critical vulnerability particularly concerning. The security issue identified as CVE-2026-82222 affects GiveWP through version 4.16.7.1. The report from BleepingComputer, published August 28, 2026, by Bill Toulas, confirms that the flaw allows unauthenticated arbitrary command execution on the hosting server. Version 4.16.7.2, released on August 27, 2026, addresses the problem. All prior versions remain vulnerable until updated.
A Three-Part Exploit Chain
Patchstack researchers explain that exploiting the vulnerability is possible by chaining three distinct issues. The first issue is an unsafe helper for unserializing PHP data. The second issue involves a donation-processing flow that stores attacker-controlled serialized objects. The third issue is a gadget chain in libraries bundled with the plugin that can invoke arbitrary system commands. Each link in this chain must function together for the attack to succeed. No single one of these issues, standing alone, provides a path to code execution. It is the combination of all three that creates the risk.
Bypassing Authentication via Registration
A critical detail involves authentication. While successful exploitation depends on the attacker having an account, Patchstack says that an exposed unauthenticated registration action allows creating an account even if registration is disabled. The give_action=user_register endpoint never consults the WordPress users_can_register option. Even on a site that has registration disabled, the attacker can create an account and receive an authentication cookie, then carry out the rest of the attack in the same sequence. As the BleepingComputer article quotes researcher George Johnstone: "[GiveWP] exposes an unauthenticated registration action (give_action=user_register) that never consults the WordPress users_can_register option." This means that sites with user registration turned off in WordPress settings remain vulnerable because the plugin's registration endpoint ignores that configuration.
From Profile to Session Database
After authentication, hackers can store a malicious serialized object in their profile and inject it into the plugin's session database by submitting a crafted donation. The server writes the gadget object into wp_give_sessions before returning an HTTP 500, as George Johnstone of Patchstack explains. By requesting any front-end page with the authentication cookie, the server unserializes the gadget and executes the command from the attacker. This is the moment where the chain becomes active: the unserialization of the gadget with the auth cookie executes the attacker's command on front-end pages. The gadget chain in bundled libraries is what allows arbitrary system command invocation at this stage.
Exploitation Conditions and Legacy Forms
Versions 4.16.6 through 4.16.7.1 remain vulnerable, although exploitation requires the site to contain a legacy donation form without 'formBuilderSettings'. Patchstack comments that such conditions may exist in upgraded installations, sites using the plugin's option-based form editor, or when importing or restoring older forms. The requirement for a legacy form creates a narrower but still significant attack surface. Sites that have never used the formBuilder interface, or that imported forms from earlier versions, may unknowingly expose this path. The donation-processing flow's acceptance of serialized objects in this context is what makes the exploitation possible.
The Fix in Version 4.16.7.2
GiveWP fixed the vulnerability in version 4.16.7.2, released on August 27, by blocking serialized data during donation processing and restricting object creation at several deserialization points. Additionally, the security update removes serialized object payloads already stored in affected databases. However, Patchstack notes that GiveWP's registration action still does not honor WordPress user registration settings, but this issue is no longer exploitable for code execution. Website administrators using GiveWP are urged to apply the security updates as soon as possible to prevent malicious exploitation of CVE-2026-82222. The fix addresses the three link points in the chain: serialized data is now blocked during donation processing, object creation is restricted at deserialization points, and existing malicious payloads are cleaned from databases.
Wider Impact and Credential Security
Hackers targeted GiveWP last year to indirectly breach Pi-hole, a popular network-level ad-blocker, exposing the names and email addresses of 30,000 donors. This incident illustrates how a WordPress plugin vulnerability can ripple outward to affect other services beyond the initial target. Once attackers have valid credentials, only 37% of their actions are blocked. Overall prevention scores can hide what happens after initial access. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. This broader context shows that initial access through a plugin vulnerability can lead to cascading compromises across an organization's technology stack.
Conclusion
The GiveWP vulnerability chain demonstrates how seemingly separate flaws can combine to create a serious security risk. The combination of unsafe deserialization, attacker-controlled objects, and a gadget chain creates a path from unauthenticated access to server command execution. The registration bypass mechanism means that even sites with WordPress registration disabled are not fully protected. Administrators should update to 4.16.7.2 immediately and review any legacy forms on their sites. The incident also reinforces the importance of monitoring not just preventive scores but what occurs after an attacker gains valid credentials. GiveWP's widespread use makes prompt updating essential for any site that accepts donations through WordPress.
This article relies on reporting from BleepingComputer's August 28, 2026, coverage of CVE-2026-82222, including statements from Patchstack researcher George Johnstone and the full technical details published in the original report.
