A maximum-severity vulnerability in the **GiveWP** plugin for **WordPress** has been discovered, posing a significant risk of remote code execution (RCE) to over 100,000 websites. Identified as **CVE-2026-82222**, this critical flaw affects **GiveWP** through version 4.16.7.1. Reported by bug researcher **Udin Chan** on July 28 via the **Patchstack** vulnerability intelligence platform, the vulnerability enables an unauthenticated attacker to execute arbitrary commands on the hosting server. The **GiveWP** plugin is popular for managing donations and fundraising campaigns. ### The Attack Chain: Chaining Multiple Vulnerabilities **Patchstack** researchers detailed that the successful exploitation of **CVE-2026-82222** relies on chaining three distinct issues: 1. An unsafe helper for unserializing **PHP** data. 2. A donation-processing flow that stores attacker-controlled serialized objects. 3. A gadget chain within libraries bundled with the plugin, capable of invoking arbitrary system commands. Crucially, while successful exploitation typically requires an account on the target site, **Patchstack** found that an exposed unauthenticated registration action allows attackers to bypass this requirement. "**[GiveWP]** exposes an unauthenticated registration action (**give_action=user_register**) that never consults the **WordPress** users_can_register option," **Patchstack** explained. "Even on a site that has registration disabled, the attacker can create an account and receive an authentication cookie, then carry out the rest of the attack in the same sequence." ### Execution of Malicious Commands Once authenticated, attackers can store a malicious serialized object in their profile. This object is then injected into the plugin’s session database by submitting a specially crafted donation. **George Johnstone**, a cybersecurity researcher at **Patchstack**, noted, "The server writes the gadget object into wp_give_sessions before returning an HTTP 500." Subsequently, by requesting any front-end page with the authentication cookie, the server deserializes the gadget, leading to the execution of the attacker's command. ### Specific Conditions for Exploitation Versions 4.16.6 through 4.16.7.1 remain vulnerable, though exploitation requires the site to contain a legacy donation form lacking 'formBuilderSettings.' **Patchstack** indicates that such conditions can exist in upgraded installations, sites utilizing the plugin’s option-based form editor, or when importing or restoring older forms. ### The Fix and Remaining Concerns **GiveWP** released version 4.16.7.2 on August 27, which addresses the vulnerability by blocking serialized data during donation processing and restricting object creation at several deserialization points. The security update also removes serialized object payloads previously stored in affected databases. However, **Patchstack** highlights that while the registration action is no longer exploitable for code execution, **GiveWP**'s registration action still does not honor **WordPress** user registration settings. This means that even if a site has user registration disabled, the **GiveWP** plugin can still allow new users to register. Website administrators using **GiveWP** are strongly advised to apply the security updates as soon as possible to prevent malicious exploitation of **CVE-2026-82222**. Last year, **GiveWP** was targeted in an attack that indirectly led to the breach of **Pi-hole**, a popular network-level ad-blocker, exposing the names and email addresses of 30,000 donors.