The popular GiveWP plugin for collecting donations on WordPress allowed the attacker to start hacking without an account and eventually execute an arbitrary system command on the server. The critical vulnerability of CVE-2026-82222 affects the GiveWP versions up to 4.16.7.1. The plugin is installed on more than 100 thousand sites, and Patchstack estimated the danger of the problem in the maximum 10 points on the CVSS scale.
The Udin Chan researcher found not one error, but a chain of several weaknesses, each of which in itself did not give full control over the server. Together, vulnerabilities turned the usual process of working with donation into a path to remote code execution.
The attack is based on the unsafe deselization of PHP. GiveWP could accept a specially prepared serialized object, save the data associated with it, and later convert the saved line into a PHP object again. In the libraries supplied together with the plugin, there was a suitable gadget chain, which allowed to bring such a substitution to the call of the system function and the launch of an arbitrary command on the server.
For part of the chain, an authorized session was required, but it was not necessary to register in advance on the site. GiveWP contained its own registration mechanism, which could create a user even when the usual WordPress registration was disabled. In the newer vulnerable versions, the developers partially limited the availability of the chain, so the specific operating conditions depended on the site configuration and the forms of donations used.
After the creation of the user, the attacker could achieve the preservation of the prepared object in the data related to the donor and the donation session. Upon subsequent reading, GiveWP again deserialized the contents, after which the built-in chain of objects allowed you to get to the execution of the command on behalf of the web server process. As a result, the attacker was potentially able to install a backdoor and fully capture the site.
Patchstack informed the developers about the vulnerability on July 28. Prior to the final correction, the researchers rejected several proposed patch options as the chain remained workable. The full correction appeared on August 27 in GiveWP 4.16.7.2, and the technical details of Patchstack revealed on August 28.
In version 4.16.7.2, the developers decided not to close the only entry point, but tore the chain in several places. GiveWP now discards suspicious serialized data before saving, prohibits the recovery of arbitrary PHP classes when reading, further clears user fields and checks objects inside the used gadget chain. The update also removes potentially dangerous serialized objects that could have entered the database before the patch was installed.
Site owners with GiveWP are advised to update the plugin to at least 4.16.7.2. Patchstack warns that vulnerabilities of this class are suitable for mass automated attacks, so delaying the fix installation is risky.
The Udin Chan researcher found not one error, but a chain of several weaknesses, each of which in itself did not give full control over the server. Together, vulnerabilities turned the usual process of working with donation into a path to remote code execution.
The attack is based on the unsafe deselization of PHP. GiveWP could accept a specially prepared serialized object, save the data associated with it, and later convert the saved line into a PHP object again. In the libraries supplied together with the plugin, there was a suitable gadget chain, which allowed to bring such a substitution to the call of the system function and the launch of an arbitrary command on the server.
For part of the chain, an authorized session was required, but it was not necessary to register in advance on the site. GiveWP contained its own registration mechanism, which could create a user even when the usual WordPress registration was disabled. In the newer vulnerable versions, the developers partially limited the availability of the chain, so the specific operating conditions depended on the site configuration and the forms of donations used.
After the creation of the user, the attacker could achieve the preservation of the prepared object in the data related to the donor and the donation session. Upon subsequent reading, GiveWP again deserialized the contents, after which the built-in chain of objects allowed you to get to the execution of the command on behalf of the web server process. As a result, the attacker was potentially able to install a backdoor and fully capture the site.
Patchstack informed the developers about the vulnerability on July 28. Prior to the final correction, the researchers rejected several proposed patch options as the chain remained workable. The full correction appeared on August 27 in GiveWP 4.16.7.2, and the technical details of Patchstack revealed on August 28.
In version 4.16.7.2, the developers decided not to close the only entry point, but tore the chain in several places. GiveWP now discards suspicious serialized data before saving, prohibits the recovery of arbitrary PHP classes when reading, further clears user fields and checks objects inside the used gadget chain. The update also removes potentially dangerous serialized objects that could have entered the database before the patch was installed.
Site owners with GiveWP are advised to update the plugin to at least 4.16.7.2. Patchstack warns that vulnerabilities of this class are suitable for mass automated attacks, so delaying the fix installation is risky.
