GiveWP flaw opens server to unauthenticated takeover

GiveWP, a popular donation plugin for WordPress with more than 100,000 installs, carries a maximum-severity vulnerability that lets an unauthenticated attacker execute arbitrary commands on the hosting server. The flaw, tracked as CVE-2026-82222, affects GiveWP through version 4.16.7.1 and was reported by researcher Udin Chan on July 28 through the Patchstack vulnerability intelligence platform.

Chain of flaws leads to takeover

Patchstack researchers explain that exploiting the vulnerability requires chaining three distinct issues: an unsafe helper for unserializing PHP data, a donation-processing flow that stores attacker-controlled serialized objects, and a gadget chain in libraries bundled with the plugin that can invoke arbitrary system commands.

Successful exploitation depends on the attacker having an account on the target site. However, Patchstack says that an exposed unauthenticated registration action allows creating an account even if registration is disabled.

“[GiveWP] exposes an unauthenticated registration action (give_action=user_register) that never consults the WordPress users_can_register option,”

— Patchstack

“Even on a site that has registration disabled, the attacker can create an account and receive an authentication cookie, then carry out the rest of the attack in the same sequence.”

How the attack unfolds

After authentication, hackers can store a malicious serialized object in their profile and inject it into the plugin’s session database by submitting a crafted donation. "The server writes the gadget object into wp_give_sessions before returning an HTTP 500," says George Johnstone, cybersecurity researcher at Patchstack.

By requesting any front-end page with the authentication cookie, the server unserializes the gadget and executes the command from the attacker.

Affected versions and conditions

Versions 4.16.6 through 4.16.7.1 remain vulnerable, although exploitation requires the site to contain a legacy donation form without ‘formBuilderSettings.’ Patchstack comments that such conditions may exist in upgraded installations, sites using the plugin’s option-based form editor, or when importing or restoring older forms.

Patch released in version 4.16.7.2

GiveWP fixed the vulnerability in version 4.16.7.2, released on August 27, by blocking serialized data during donation processing and restricting object creation at several deserialization points. Additionally, the security update removes serialized object payloads already stored in affected databases.

However, Patchstack notes that GiveWP’s registration action still does not honor WordPress user registration settings, but this issue is no longer exploitable for code execution.

Urgent call to update

Website administrators using GiveWP are urged to apply the security updates as soon as possible to prevent malicious exploitation of CVE-2026-82222.

Prior targeting leads to breach

Hackers targeted GiveWP last year to indirectly breach Pi-hole, a popular network-level ad-blocker, exposing the names and email addresses of 30,000 donors. That incident underscores the real-world impact of GiveWP flaws.

Why this matters for site admins

This vulnerability is particularly dangerous because it combines an unauthenticated account creation with a chain that leads to full server compromise. Even sites with registration disabled are at risk if they use affected versions and have legacy forms. The fix is available, but administrators must act quickly to avoid becoming the next target.