Critical GiveWP WordPress Plugin Vulnerability Allows Unauthenticated Server Command Execution

The GiveWP plugin for WordPress, which is used on more than 100,000 sites to manage donations and fundraising campaigns, contains a critical vulnerability that allows unauthenticated attackers to execute arbitrary commands on the hosting server. The flaw, tracked as CVE-2026-82222, was reported by researcher Udin Chan on July 28 through the Patchstack vulnerability intelligence platform and affects all versions up to and including 4.16.7.1.

According to Patchstack, exploiting the vulnerability requires chaining three separate weaknesses. First, the plugin exposes an unauthenticated registration action (give_action=user_register) that does not check WordPress's user registration setting. Even on sites where registration is disabled, an attacker can create an account and receive an authentication cookie. Second, after authenticating, the attacker can store a malicious serialized object in their profile and inject it into the plugin's session database by submitting a specially crafted donation. The server writes this payload into the wp_give_sessions table before returning an HTTP 500 error. Third, when the attacker requests any front-end page while authenticated, the server unserializes the malicious object and executes the attacker's command.

Patchstack notes that versions 4.16.6 through 4.16.7.1 remain vulnerable, but successful exploitation requires the target site to contain a legacy donation form that lacks the formBuilderSettings property. Such forms may be present in installations that were upgraded from older versions, sites using the plugin's option-based form editor, or when older forms are imported or restored.

GiveWP fixed the vulnerability in version 4.16.7.2, released on August 27. The update blocks serialized data during donation processing and restricts object creation at multiple deserialization points. It also removes serialized object payloads already stored in affected databases. Patchstack adds that while the registration action still does not honor WordPress user registration settings, this residual issue is no longer exploitable for code execution.

The vulnerability is considered maximum severity because it can be exploited without any prior authentication thanks to the registration bypass. Although an attacker needs an account on the target site, the bypass makes it trivial to obtain one. Successful exploitation could give attackers full control over the web server, potentially leading to data theft, malware deployment, or site defacement.

Website administrators using GiveWP are strongly urged to apply the security update immediately. The plugin has been targeted by hackers in the past; last year, attackers breached GiveWP to indirectly compromise Pi-hole, a network-level ad blocker, exposing the names and email addresses of 30,000 donors.