Critical GiveWP plugin vulnerability allows unauthenticated remote code execution
A maximum-severity vulnerability (CVE-2026-82222) in the GiveWP WordPress donation plugin allows unauthenticated attackers to execute arbitrary commands on the hosting server. Exploitation chains three issues, including an unsafe unserialize helper and a gadget chain, and requires an attacker to create an account even if registration is disabled. The plugin fixed the issue in version 4.16.7.2, released on August 27.
The flaw chains an unsafe unserialize helper, a donation flow that stores attacker-controlled serialized objects, and a gadget chain from bundled libraries. Exploitation requires an account, but the plugin’s registration action bypasses WordPress’s disabled-registration setting, letting attackers create one and obtain an authentication cookie. After storing a malicious object in their profile, a crafted donation injects it into the session database, and any front-end page request triggers command execution.
The vulnerable versions span 4.16.6 through 4.16.7.1, but only when a legacy donation form lacking ‘formBuilderSettings’ exists—common in upgraded or restored installations. GiveWP’s fix, version 4.16.7.2, blocks serialized data during donation processing, restricts object creation at deserialization points, and removes existing malicious payloads. The registration action remains non-compliant with user settings, though no longer exploitable for code execution.
This vulnerability could affect over 100,000 WordPress sites using GiveWP, particularly nonprofits and small organizations that rely on donation plugins. If exploited, attackers gain full server control, potentially stealing donor data, defacing sites, or pivoting to other infrastructure. The unauthenticated account creation bypass means even locked-down sites may be exposed. While the patch is available, delayed updates could leave many organizations vulnerable, risking financial and reputational harm, as seen in last year’s Pi-hole breach.