If you run a WordPress site with the GiveWP donation plugin, patch it immediately. A maximum-severity vulnerability (CVE-2026-82222, CVSS 10.0) has been discovered that allows an unauthenticated attacker to execute arbitrary commands on your server. This is not a theoretical issue — the exploit chain has been publicly detailed, and active scanning is already underway.
## What Is GiveWP?
GiveWP is a popular WordPress donation and fundraising plugin with over 100,000 active installs. It is used by nonprofits, charities, churches, and other organizations to collect donations and manage fundraising campaigns directly from their WordPress sites. The plugin’s widespread adoption makes it a high-value target.
## The Vulnerability: CVE-2026-82222
Discovered by researcher Udin Chan and reported through Patchstack on July 28, CVE-2026-82222 is a PHP object injection vulnerability that chains together three distinct weaknesses to achieve full remote code execution:
First, the plugin exposes an unauthenticated user registration action (give_action=user_register) that never checks the WordPress users_can_register setting. Even with registration disabled, an attacker can create an account and receive an authentication cookie in a single request.
Second, once authenticated, the attacker can store a malicious serialized PHP object in their user profile and inject it into the plugin’s session database by submitting a crafted donation request. The server writes this gadget object into the wp_give_sessions table before returning an HTTP 500 error.
Third, when the attacker requests any front-end page while holding the authentication cookie, the server unserializes the stored gadget and executes the attacker’s command. The result: full remote code execution on the hosting server.
## Affected Versions
All versions of GiveWP from 4.16.6 through 4.16.7.1 are vulnerable. However, exploitation requires the site to contain at least one legacy donation form without ‘formBuilderSettings.’ This condition is common on upgraded installations, sites using the option-based form editor, or sites that imported or restored older forms.
## The Fix
GiveWP released version 4.16.7.2 on August 27, 2026, which blocks serialized data during donation processing and restricts object creation at several deserialization points. The update also actively removes any serialized object payloads already stored in affected databases.
Patchstack notes that while the registration action still does not honor WordPress user registration settings after the patch, this is no longer exploitable for code execution.
## Why This Matters
This is a CVSS 10.0 vulnerability — the maximum severity rating. It requires no authentication, no special privileges, and no user interaction. Combine that with 100,000+ active installations, and you have a recipe for widespread compromise.
This is not the first time GiveWP has been targeted. Last year, attackers exploited a GiveWP vulnerability to breach Pi-hole, the popular network-level ad-blocker, exposing the names and email addresses of 30,000 donors. The plugin has become a proven attack vector.
## Action Items for Site Administrators
If you run GiveWP on any WordPress site, take these steps immediately:
Update GiveWP to version 4.16.7.2 or later right now. Go to your WordPress admin dashboard, navigate to Plugins, and update GiveWP. If automatic updates are enabled, verify the update has applied.
Check your site for signs of compromise. Review wp_give_sessions entries for suspicious serialized data. Look for unexpected admin accounts or files in your uploads directory.
If you find evidence of compromise — unexpected admin users, strange files, or odd database entries — assume the attacker has full server access and rotate all credentials, API keys, and secrets stored on that server. Consider a full restore from a known-clean backup.
Enable automatic plugin updates if you have not already. This reduces the window between vulnerability disclosure and patch application.
Monitor your WordPress site’s user registration activity. Even with registration disabled, this vulnerability could create accounts. Watch for unexpected new users with subscriber or higher roles.
## Bottom Line
CVE-2026-82222 is a textbook example of how seemingly minor coding mistakes — a registration bypass, an unserialize call on untrusted data, and shipped development libraries — combine into a maximum-severity RCE. If you use GiveWP, patch now. There is no excuse to leave 100,000+ installs exposed to unauthenticated server takeover.