A maximum-severity vulnerability in the widely-used GiveWP plugin allows unauthenticated attackers to take control of hosting servers via arbitrary command execution.

  • Vulnerability CVE-2026-82222 affects GiveWP versions up to 4.16.7.1.
  • Attackers can bypass registration restrictions to create accounts.
  • Immediate update to version 4.16.7.2 is required to mitigate risks.

Security researchers have uncovered a maximum-severity vulnerability in GiveWP, a prominent WordPress donation plugin used by over 100,000 installations. The flaw, identified as CVE-2026-82222, provides a pathway for unauthenticated attackers to execute arbitrary system commands on the host server, potentially leading to a full site takeover.

The Mechanics of the Exploit

According to findings from Patchstack, the exploit is achieved by chaining three distinct architectural weaknesses. It begins with an unsafe PHP deserialization helper, followed by a donation-processing flow that allows attacker-controlled serialized objects to be stored. Finally, a 'gadget chain' within the plugin's bundled libraries is used to trigger system-level commands.

Read Also:Phineas Fisher: The Elusive Hacktivist Who Dismantled Spyware Giants

Why This Matters

BozokMedia analysis shows that the danger is amplified by a logic flaw in how the plugin handles user registration. Even if a website administrator has disabled user registration in WordPress settings, the GiveWP plugin exposes an unauthenticated action (give_action=user_register) that ignores these restrictions, allowing attackers to create accounts and obtain authentication cookies effortlessly.

The ability to bypass standard WordPress registration settings makes this vulnerability a high-priority threat for non-technical administrators.

Once an account is established, the attacker can inject a malicious serialized object into their profile. By submitting a specifically crafted donation, this object is written into the wp_give_sessions database table. Upon the next request to a front-end page, the server unserializes the object, inadvertently executing the attacker's payload.

Historical Context of Attacks

The vulnerability follows a pattern of targeting GiveWP to reach larger targets. Last year, attackers exploited GiveWP to indirectly breach Pi-hole, resulting in the exposure of sensitive data belonging to 30,000 donors. This highlights the plugin's role as a high-value target in the WordPress ecosystem.

Did You Know?: Many security tools focus on preventing initial access, but once an attacker has valid credentials, the effectiveness of many traditional prevention defenses drops significantly.

Frequently Asked Questions

1. How do I know if my site is vulnerable?
If you are running GiveWP version 4.16.7.1 or lower, your site is likely at risk.

2. What is the fix?
Developers have released version 4.16.7.2, which blocks serialized data during processing and cleans existing malicious payloads.