Critical GiveWP Flaw Lets Attackers Run Commands on WordPress Servers
Critical unauthenticated PHP object injection (CVE-2026-82222) in the GiveWP WordPress donation plugin chains to remote code execution; version 4.16.7.2 fixes it.
Patchstack disclosed CVE-2026-82222 (CVSS 10.0), an unauthenticated PHP object injection in GiveWP versions through 4.16.7.1 that chains through TCPDF and Give\TestData gadget classes to arbitrary OS command execution as the web server user. On versions 4.16.5.1 and below, a default installation with one published donation form is enough to exploit, with no user interaction required. Version 4.16.7.2 blocks unsafe serialized data, hardens the gadget chain and cleans already-stored database records; a separate registration bypass issue remains unresolved.
- CVE-2026-82222 scored CVSS 10.0; no authentication or user interaction required
- Allowed_classes=>false leaves a __PHP_Incomplete_Class payload that is later deserialized unprotected
- Gadget chain via TCPDF and Give\TestData reaches an attacker-controlled function call such as system()
- Fix 4.16.7.2 rejects malicious serialized data and scrubs existing database records
- Admins urged to update, review logs for compromise and check legacy donation forms
- CVEs
- CVE-2026-82222
- Organizations
- Patchstack
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82222 | Unauthenticated PHP Object Injection Leading to RCE in GiveWP WordPress Plugin | 10.0 | 2% | PoC |
From the original article
4 min read at securityaffairs.com
A critical GiveWP flaw lets unauthenticated attackers execute server commands. Version 4. 16.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.