GiveWP WordPress Donation Plugin Flaw (CVE-2026-82222) Lets Attackers Execute Server Commands

Key facts for GiveWP plugin deserialization RCE

Detection coverage for GiveWP plugin deserialization RCE

As of 2026-08-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2188 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Web Server Worker Process Spawning Command Interpreter (GiveWP ProviderForwarder RCE)

Detects a PHP-FPM, Apache, or Nginx worker process spawning a shell or common attacker living-off-the-land binary, consistent with the ProviderForwarder::__call() -> call_user_func_array() -> system() gadget chain reaching arbitrary OS command execution in CVE-2026-82222.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059, T1059.004, T1190
• Data sources: sysmon_for_linux, edr_process_telemetry, auditd
• Severity: critical
• Confidence: high

Splunk SPL

index=endpoint sourcetype="Sysmon:Linux" EventCode=1
(ParentImage="*php-fpm*" OR ParentImage="*apache2*" OR ParentImage="*httpd*" OR ParentImage="*nginx*")
Image IN ("/bin/sh","/bin/bash","/usr/bin/curl","/usr/bin/wget","/usr/bin/id","/usr/bin/whoami","/usr/bin/python3","/usr/bin/perl")
| table _time host ParentImage Image CommandLine User
| sort - _time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("php-fpm","php-fpm7.4","php-fpm8.1","apache2","httpd","nginx")
| where FileName in~ ("sh","bash","curl","wget","id","whoami","python3","perl")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName

Sigma

title: Web Server Worker Process Spawning Command Interpreter (GiveWP ProviderForwarder RCE)
id: 4e6f8a0c-2d4e-4f6a-8c0e-3f5a7c9e1b3d
status: experimental
description: Detects a PHP-FPM, Apache, or Nginx worker process spawning a shell or common attacker living-off-the-land binary, consistent with the ProviderForwarder::__call() -> call_user_func_array() -> system() gadget chain reaching arbitrary OS command execution in CVE-2026-82222.
references:
    - https://patchstack.com/articles/unauthenticated-php-object-injection-to-remote-code-execution-on-givewp
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-28
tags:
    - attack.execution
    - attack.t1059
    - attack.t1059.004
    - attack.initial-access
    - attack.t1190
    - cve.2026.82222
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent:
        ParentImage|contains:
            - 'php-fpm'
            - 'apache2'
            - 'httpd'
            - 'nginx'
    selection_child:
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/curl'
            - '/wget'
            - '/id'
            - '/whoami'
            - '/python3'
            - '/perl'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate WordPress plugins/cron jobs that intentionally shell out (image/PDF conversion tools, backup plugins) — baseline per host before alerting
    - Package-manager or health-check scripts invoked by a supervisor process misidentified as the web server
level: critical

Known false positives:

• Legitimate WordPress plugins/cron jobs that intentionally shell out (image/PDF conversion tools, backup plugins) — baseline per host before alerting
• Package-manager or health-check scripts invoked by a supervisor process misidentified as the web server

Tuning notes: Baseline legitimate PHP shell-out behavior per host (e.g. ImageMagick, wkhtmltopdf, backup plugins) and add them to an allowlist rather than excluding the parent-process match entirely.

• 🔒 GiveWP Plugin Version Fingerprinting Followed by Unauthenticated Registration Call · unlock with TL Creds
• 🔒 GiveWP Donation Processing HTTP 500 Following give_last Omission (wp_give_sessions Poisoning) · unlock with TL Creds
• 🔒 Outbound Network Connection from Web Server Worker Following GiveWP Exploitation · unlock with TL Creds
• 🔒 Unauthenticated GiveWP Donation Submission Missing give_last (Session Poisoning Trigger) · unlock with TL Creds
• 🔒 GiveWP TestData ProviderForwarder Gadget Reactivation in PHP Error Log · unlock with TL Creds
• 🔒 PHP File Written to WordPress wp-content by Web Server Process (Post-GiveWP-RCE Webshell Drop) · unlock with TL Creds
• 🔒 GiveWP Nonce Reuse Across Multiple Source IPs (Registration/Donation Bypass Chain) · unlock with TL Creds
• 🔒 PHP Serialized Object Marker in GiveWP profile.php or Donation POST Body · unlock with TL Creds

Indicators of compromise for GiveWP plugin deserialization RCE

As of 2026-08-28, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-2188.

How GiveWP plugin deserialization RCE works

An exposed unauthenticated registration action lets attackers create an account even with WordPress registration disabled, removing the last barrier to exploitation. Fixed in version 4.16.7.2, released 2026-08-27.

CVE-2026-82222 is a CVSS 10.0 / CWE-502 unauthenticated PHP object injection vulnerability in GiveWP, a WordPress donation and fundraising plugin maintained by StellarWP/Liquid Web with more than 100,000 active installations. Security researcher Udin Chan reported the flaw to Patchstack on 2026-07-28; Patchstack researcher George Johnstone published the technical analysis, and the vendor shipped a fix in version 4.16.7.2 on 2026-08-27.

The vulnerability chains three distinct issues. First, GiveWP exposes an unauthenticated `give_action=user_register` action that never consults WordPress's `users_can_register` setting, letting an attacker create an account and receive an authentication cookie even on sites with registration disabled. A 4.16.6 attempt to gate this with a nonce was ineffective because the nonce rendered by the public `[give_register]` shortcode is identical for every logged-out visitor to the same page and can simply be harvested and reused. Second, the attacker harvests a second, separately-reusable nonce rendered on the donor `profile.php` editor page (the same identical-nonce-for-every-anonymous/authenticated-visitor weakness as the registration bypass) and uses it to POST a malicious PHP serialized object into the newly created account's `last_name` user-meta field. Submitting a donation (`give_action=give_process_donation`) that omits `give_last` causes `give_process_donation_form()` to pull the poisoned `last_name` value and `give_set_purchase_session()` to persist it, unserialized, into the `wp_give_sessions` database table before the request returns an HTTP 500; because this value is read back from the account rather than taken directly from the request, ordinary input validation on the donation POST never inspects it. Third, GiveWP's `Give\Helpers\Utils::maybeSafeUnserialize()`/`safeUnserialize()` helper calls PHP's `unserialize()` with `allowed_classes => false`, which prevents the object from being instantiated on the spot but returns a `__PHP_Incomplete_Class` placeholder — critically, when that placeholder is serialized again PHP writes the exact original class name and property bytes back out unchanged, so the gadget survives intact and comes to life when the session data is later read and re-serialized/re-unserialized on a subsequent authenticated page request. The terminal gadget lives in GiveWP's bundled TestData framework: `Give\TestData\Framework\ProviderForwarder::__call()` executes `call_user_func_array($this->loadedProviders[$name], $arguments)`, and an attacker who controls `loadedProviders` can point it at `system()` with an arbitrary OS command, reached via a TCPDF `__destruct()`/`_destroy()` entry point bundled with the plugin.

Exploitability is version-dependent. On 4.16.5.1 and earlier the chain is reachable by default (the plugin ships active `manual`/`offline` gateways and needs only one published donation form). Versions 4.16.6 through 4.16.7.1 narrowed reachability because the legacy donation processor rejects Visual Form Builder v3 forms, but any `give_forms` post lacking `formBuilderSettings` — regardless of status (draft, trash, published), covering upgraded sites, imports, and sites with the "Option-Based Form Editor" enabled — re-opens the chain. Version 4.16.7.2 closes the flaw by blocking serialized data during donation processing, restricting object creation at deserialization points, and stripping any already-stored malicious payloads from the database.

Patchstack characterizes this as high-priority and expects mass-campaign exploitation against WordPress sites running vulnerable GiveWP versions, consistent with the plugin's history of prior object-injection/deserialization issues (e.g., CVE-2025-22777, CVE-2024-5932). As of this writing there is no public literal exploit script and no confirmed in-the-wild exploitation or CISA KEV listing, but the publicly documented function/class-level exploitation chain is detailed enough to be functionally equivalent to a public PoC for a capable attacker.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter; T1059.004 Unix Shell

Persistence

T1078 Valid Accounts; T1136.001 Local Account

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1565.001 Stored Data Manipulation

Resource Development

T1588.006 Vulnerabilities

Reconnaissance

T1592.002 Software; T1594 Search Victim-Owned Websites

Remediation for GiveWP plugin deserialization RCE

Patches

• GiveWP 4.16.7.2 (released 2026-08-27) — blocks serialized data during donation processing, restricts object instantiation at deserialization points, and strips existing stored malicious payloads from the database.

Immediate actions

• Update GiveWP to version 4.16.7.2 or later immediately on every WordPress site where it is installed.
• Audit the `wp_give_sessions` table and the `last_name` user-meta field for all site accounts for anomalous PHP serialized-object data (values beginning with `O:`), and purge any found.
• Review recently created WordPress user accounts for unexpected registrations via the `give_action=user_register` endpoint, especially on sites where 'Anyone can register' is disabled.

Workarounds

• Where immediate patching is not possible, disable GiveWP donation forms and the `[give_register]` shortcode, and block requests containing `give_action=user_register` or `give_action=give_process_donation` targeting legacy (non-`formBuilderSettings`) form IDs at the WAF layer.

Longer-term hardening

• Deploy a WAF/reverse-proxy rule blocking PHP serialization markers (`O:<len>:"<class>"`) in donation-form and profile-update POST bodies.
• Disable or restrict the public `[give_register]` shortcode where self-service donor account creation is not required.
• Monitor PHP-FPM/Apache worker processes on WordPress hosts for unexpected `system()`/shell-exec child processes.

Affected and fixed versions

• StellarWP / Liquid Web — GiveWP – Donation Plugin and Fundraising Platform (WordPress plugin, slug `give`)
  Vulnerable versions: through 4.16.7.1 (full default-install chain on 4.16.5.1 and earlier; requires a form lacking formBuilderSettings on 4.16.6–4.16.7.1)
  Fixed in: 4.16.7.2

Timeline of GiveWP plugin deserialization RCE

• 2026-07-28 Security researcher locked-ioc-9 reports the PHP object injection / registration bypass chain in GiveWP to locked-ioc-8; vendor is contacted.
• 2026-08-20 GiveWP 4.16.7 is released with unrelated security hardening (donor-account email access authentication, checkout login form validation) while CVE-2026-82222 remains unpatched.
• 2026-08-24 locked-ioc-6 is released (PayPal Donations order-request validation); the CVE-2026-82222 object-injection chain remains exploitable via forms lacking formBuilderSettings.
• 2026-08-27 locked-ioc-7 is released, blocking serialized data in donation processing, restricting deserialization object creation, and stripping stored malicious payloads — fixing CVE-2026-82222.
• 2026-08-28 BleepingComputer reports on the flaw, noting the plugin's 100,000+ active installations and the unauthenticated registration bypass.
• 2026-08-28 locked-ioc-8 publishes technical analysis of the unauthenticated PHP object injection to RCE chain, crediting locked-ioc-9 and researcher George Johnstone.
• 2026-08-28 CVE-2026-82222 is published with a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Sources cited for GiveWP plugin deserialization RCE

• Unauthenticated PHP Object Injection to Remote Code Execution on GiveWP patchstack.com · Advisory · 2026-08-28
• WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability patchstack.com · Advisory · 2026-08-28
• NVD - CVE-2026-82222 NVD (NIST) · Advisory · 2026-08-28
• CISA Known Exploited Vulnerabilities Catalog (checked 2026-08-28 — CVE-2026-82222 not listed) CISA · Government advisory · 2026-08-28
• GiveWP – Donation Plugin and Fundraising Platform (WordPress.org plugin listing) wordpress.org · Vendor report · 2026-08-27
• GiveWP changelog (develop) — 4.16.7 / 4.16.7.1 / 4.16.7.2 entries GitHub · Code repository · 2026-08-27
• GiveWP WordPress donation plugin flaw lets hackers execute server commands BleepingComputer · News · 2026-08-28

Threats related to GiveWP plugin deserialization RCE

• Five Critical WordPress Plugin/Theme Flaws (CVSS up to 10.0) Enable Site Takeover or RCE: WPMU DEV Dashboard, Avada/Fusion Builder, TranslatePress, Pods, GiveWP
• Snowflake GitHub Actions Workflow Injection Exposes Internal Jira Credentials
• Claude-Powered AI Agent (OpenClaw) Autonomously Exploits Broken Access Control Flaw in Gym Booking API
• Critical Elementor Pro unauthenticated file upload vulnerability leads to RCE on WordPress sites (CVE-2026-32475)
• Critical Meta IDOR Flaw in Support Case Infrastructure Exposed Customer Emails, Transcripts, and Internal Notes (Meta Horizon Managed Solutions / Meta.com Support)

Related coverage of this activity

• Buffa Rust protobuf DoS
• Wiz Red Agent airline BOLA
• KindaRails2Shell Active Storage flaw
• Microsoft Edge CVE-2026-58525