Vendor

GiveWP

0 mentions in 7 days · 2 in 30 days · 2 total · first seen Aug 28, 2026 · last 15d ago

Timeline2 articles

Critical GiveWP Flaw Lets Attackers Run Commands on WordPress Servers

Critical unauthenticated PHP object injection (CVE-2026-82222) in the GiveWP WordPress donation plugin chains to remote code execution; version 4.16.7.2 fixes it.

Patchstack disclosed CVE-2026-82222 (CVSS 10.0), an unauthenticated PHP object injection in GiveWP versions through 4.16.7.1 that chains through TCPDF and Give\TestData gadget classes to arbitrary OS command execution as the web server user. On versions 4.16.5.1 and below, a default installation with one published donation form is enough to exploit, with no user interaction required. Version 4.16.7.2 blocks unsafe serialized data, hardens the gadget chain and cleans already-stored database records; a separate registration bypass issue remains unresolved.

Security AffairsAug 31, 07:54 UTC · 15d agoVulnerability CVE-2026-82222

Unauthenticated PHP Object Injection to Remote Code Execution on GiveWP

Patchstack details an unauthenticated PHP object injection chain enabling remote code execution in the GiveWP WordPress donation plugin.

Patchstack disclosed an unauthenticated remote code execution vulnerability in the GiveWP WordPress donation plugin. An attacker with no account can execute arbitrary commands on the server of an affected GiveWP site. The full chain is reachable when a site has one published donation form and one active payment gateway, a configuration the researcher describes as a common default.

PatchstackAug 28, 09:39 UTC · 18d agoVulnerability

Related CVEsby mentions

CVE-2026-8222210.02%
Unauthenticated PHP Object Injection Leading to RCE in GiveWP WordPress Plugin
CVE-2026-82222 is a deserialization of untrusted data flaw (CWE-502) in the GiveWP donation plugin for WordPress, developed by Liquid Web / StellarWP, affecting all versions through 4.16.7.1. The vulnerable code path is reachable over the network without authentication (CVSS vector AV:N/AC:L/PR:N), allowing an attacker to supply a crafted serialized object that the plugin unserializes, resulting in PHP object injection. By exploiting gadget chains in the plugin or WordPress core, the attacker can achieve remote code execution and run commands on the WordPress server, with the scope-changed CVSS rating and high confidentiality, integrity, and availability impacts indicating full site or server compromise is possible. Any WordPress site running GiveWP version 4.16.7.1 or older is affected, and because donation plugins are typically deployed on donor-facing public pages, the vulnerable endpoints are often directly exposed to the internet. A public proof-of-concept exists, but current exploitation risk is assessed as low: EPSS is 0.4% (35th percentile) and the flaw is not yet in CISA's Known Exploited Vulnerabilities catalog.
· Liquid Web / StellarWP GiveWP (WordPress plugin) all versions from n/a through 4.16.7.1 PoC large

Appears with

product GiveWP 2 product WordPress 2 vendor Patchstack 2 organization Patchstack 1 vendor TCPDF 1 vendor WordPress 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.