Critical GiveWP Donation Plugin Flaw Enables Remote Code Execution on WordPress Sites
A maximum-severity vulnerability tracked as CVE-2026-82222 affects the GiveWP donation plugin for WordPress, allowing attackers to execute arbitrary commands on the hosting server. The flaw impacts GiveWP through version 4.16.7.1 and affects more than 100,000 installations. Researcher Udin Chan reported the issue on July 28 through the Patchstack vulnerability intelligence platform.
Patchstack researchers explain that exploitation requires chaining three distinct issues: an unsafe helper for unserializing PHP data, a donation-processing flow that stores attacker-controlled serialized objects, and a gadget chain in bundled libraries that can invoke system commands. Although exploitation requires an attacker account, an exposed unauthenticated registration action lets hackers create accounts even on sites where registration is disabled. After authenticating, an attacker stores a malicious serialized object in their profile, injects it into the plugin's session database via a crafted donation, and triggers execution of the command by requesting any front-end page.
Versions 4.16.6 through 4.16.7.1 remain vulnerable, though exploitation depends on the site containing a legacy donation form without formBuilderSettings, a condition that may exist in upgraded installations or sites importing older forms. GiveWP fixes the vulnerability in version 4.16.7.2, released on August 27, by blocking serialized data during donation processing and restricting object creation at several deserialization points. Administrators running the plugin should update immediately to protect their servers from potential compromise.