CVE-2026-82222

CVE-2026-82222 is a deserialization of untrusted data flaw (CWE-502) in the GiveWP donation plugin for WordPress, developed by Liquid Web / StellarWP, affecting all versions through 4.16.7.1. The vulnerable code path is reachable over the network without authentication (CVSS vector AV:N/AC:L/PR:N), allowing an attacker to supply a crafted serialized object that the plugin unserializes, resulting in PHP object injection. By exploiting gadget chains in the plugin or WordPress core, the attacker can achieve remote code execution and run commands on the WordPress server, with the scope-changed CVSS rating and high confidentiality, integrity, and availability impacts indicating full site or server compromise is possible. Any WordPress site running GiveWP version 4.16.7.1 or older is affected, and because donation plugins are typically deployed on donor-facing public pages, the vulnerable endpoints are often directly exposed to the internet. A public proof-of-concept exists, but current exploitation risk is assessed as low: EPSS is 0.4% (35th percentile) and the flaw is not yet in CISA's Known Exploited Vulnerabilities catalog.

What to do: Immediately update GiveWP to the latest patched release (any version newer than 4.16.7.1); verify the installed version on the WordPress plugins admin page before and after updating. If updating is not yet possible, temporarily deactivate or restrict access to the plugin's public endpoints and review web and PHP logs for unexpected serialized payloads or newly created admin users and unknown files indicative of object-injection exploitation. Continue monitoring, as a public PoC is available and weaponization could raise the exploitation risk even though EPSS is currently low.